Red Hat Security Advisory: Submariner v0.21 security fixes and container updates

CVE-2024-25621 — github.com/containerd/containerd: containerd local privilege escalation CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68151 — github.com/coredns/coredns/core/dnsserver: CoreDNS DoS via unbounded connections and oversized messages CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-26017 — github.com/coredns/coredns: CoreDNS: DNS access control bypass due to plugin execution order flaw CVE-2026-26018 — github.com/coredns/coredns: CoreDNS: Denial of Service vulnerability due to predictable pseudo-random number generation CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32936 — github.com/coredns/coredns: CoreDNS: Denial of Service via oversized DNS-over-HTTPS GET requests CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35579 — github.com/coredns/coredns: CoreDNS: Authentication bypass allows unauthorized access to TSIG-protected functionalities