RHSA-2026:7291 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
os: os: Information disclosure via path traversal using specially crafted filenames net/http: CrossOriginProtection bypass in net/http golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html net/url: Insufficient validation of bracketed IPv6 hostnames in net/url golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication golang: archive/tar: Unbounded allocation when parsing GNU sparse map encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1 golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http crypto/x509: Quadratic complexity when checking name constraints in crypto/x509 crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information golang.org/x/net/html: Infinite parsing loop in golang.org/x/net encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto net/mail: Excessive CPU consumption in ParseAddress in net/mail golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy cmd/go: cmd/go: Local code execution and arbitrary file write via malicious module version strings crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 crypto/x509: Panic in name constraint checking for malformed certificates in crypto/x509 os: FileInfo can escape from a Root in golang os module golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames html/template: URLs in meta content attribute actions are not escaped in html/template golang: cmd/compile: possible memory corruption after bound check elimination golang: cmd/compile: no-op interface conversion bypasses overlap checking crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archive html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals golang: golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via maliciously crafted TIFF file crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
CVSS v3.1 score: 8.8