RHSA-2026:11408HighCVSS 9.1

Red Hat Security Advisory: VolSync v0.14 security fixes and container updates

Published
April 28, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (5)

CVE-2026-33186 →CVE-2025-61726 →CVE-2025-61728 →CVE-2025-61729 →CVE-2026-32282 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products6

  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/volsync-operator-bundle@sha256:3053d9922016840bb6e2a14c783b61cd1799e345139b4a799b35c444e4b19ebd_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/volsync-rhel9@sha256:15a198e39cc0d139796a6cc9fa3bc0e6607776b0020f044452265e0868e44598_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/volsync-rhel9@sha256:b92dc6fa8b2f0bb35daaa710056cf9c001728ad004679a4987e634899c631d65_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/volsync-rhel9@sha256:dcd8cd73020fa1704bf7f5e21db0c15fb6696a555e57c5dd5d7f6fe5c97f6eba_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/volsync-rhel9@sha256:e251496656ed10eafdf45be0a0273d849e7df585e83b52624326df77edfa3a5a_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/business_continuity/business-cont-overview#volsync Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (8)