RHSA-2026:28441HighCVSS 7.5

Red Hat Security Advisory: Red Hat Openshift Mirror Registry v2.0.11

Published
June 23, 2026
Last Modified
August 30, 2026

🔗 CVE IDs covered (11)

CVE-2025-61726 →CVE-2025-61729 →CVE-2025-66418 →CVE-2025-68121 →CVE-2026-21441 →CVE-2026-32280 →CVE-2026-32281 →CVE-2026-32589 →CVE-2025-66471 →CVE-2026-25679 →CVE-2026-32590 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32589 — mirror-registry: quay: insecure direct object reference in BlobUpload CVE-2026-32590 — mirror-registry: remote code execution using pickle deserialization

🎯 Affected products4

  • mirror registry for Red Hat OpenShift 2.0
  • registry.redhat.io/openshift/mirror-registry-rhel8@sha256:8a0035c2841dbc7ae063f1298006ef23509dba3bc02a99f19915033255df4a29_s390x as a component of mirror registry for Red Hat OpenShift 2.0
  • registry.redhat.io/openshift/mirror-registry-rhel8@sha256:97ecafca4a852ecc1f897eaa54ced5a3301d53981ed6a7f5dee20d3a33db0d48_ppc64le as a component of mirror registry for Red Hat OpenShift 2.0
  • registry.redhat.io/openshift/mirror-registry-rhel8@sha256:d1d86fccb45733d6be9a15f64ea8a6c7953a72d58c95f6b67c7f55dd8107ca9e_amd64 as a component of mirror registry for Red Hat OpenShift 2.0

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (14)