RHSA-2026:14391HighCVSS 8.8

Red Hat Security Advisory: Red Hat build of Cryostat security update

Published
May 6, 2026
Last Modified
August 13, 2026

🔗 CVE IDs covered (4)

CVE-2026-32280 →CVE-2026-32282 →CVE-2026-32283 →CVE-2026-33810 →

📋 Description

CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

🎯 Affected products21

  • Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:f0b40e2312ae2659f9d0092a98488d7c5965ab33efe759ce78778b1b8173c5d6_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:f2aeac65f02f6d21b497972087a808104100b547d92ab1a5656d91b48262c97d_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:231d5f0956e242c675b2f33df01d7a1fd9f44c9ee80f2b05731a60e0022e1483_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:8c6ca482631927526d6e8d1ca455cffc379d798c7d8d323c699e7ffc5ff44c88_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:2e68b360df2e9532458e97127a16e10765c3e7bbe4842d6ad48febca834af1f2_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:e0092c9adc9bf671729ec2a4682f3c53f1f12a9fdf09edf5f5c4b65172e04742_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:03b2d5ec8747fa2984b4659b0d61c5dd67dd729c6957918752b8033a3e6f40ec_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:5d356babef136df86f11f77ec595d9e9cc9a7f246eeb458e062757e273a9e803_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:5479230ed1ace22b8f00141796326cae84a772b1b6f14f52a58366a9695266da_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:b2a02cd673f7dd96218aa92a11bb924eb4538060f77fb8e773d0f13f5bdec55f_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:71ff61b5a765e62ef16bd633580dc9d49e8fcb46a68c3ee0e831d161b598956a_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:fb4b8f8338d6f3b7458ec9643d49175333a69d15650f026a1038836668f0c076_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:b3c9c59b462a94d181b51ee7419c5e89618da06bb70d7905f7efeeca12e57c6b_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:c4a8388737cd5330176421462353b4253dcbf4c7dc963b644b5d122cda3022d1_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:548ef61d03e7b861bed4b2f86cb826add8fcf13251d34562a4ac78302eae9d88_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:6daca9dff828394e3181355526276fdc6448eace218fc3c30b63b992bee5424d_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:95938fed3fcf7e786bcc418e5cc05999519336dd9b1ae26ac09b87d122244ce9_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:95c41160b310ef0c54ddab4fd77dfaf02faf62de58d15b3a90b375c76226181c_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:914d1985a1944cf4c25530b67aad321e7a8d6f28cfb7793b703b69456deecf8a_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:965a1522fc45c8aeff07508ba9291919bd007318da0511ee2ed4e4c18190ec71_amd64 as a component of Cryostat 4 on RHEL 9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)