RHSA-2026:3184HighCVSS 7.5

Red Hat Security Advisory: RHTAS - Tech Preview Release Of the Policy Controller Operator

Published
February 24, 2026
Last Modified
September 2, 2026

🔗 CVE IDs covered (2)

CVE-2025-61726 →CVE-2025-61729 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate

🎯 Affected products2

  • Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/policy-controller-rhel9@sha256:9d58554741550455323ef4b402a366a2ae1a3e372a834af37461a44893793976_amd64 as a component of Red Hat Trusted Artifact Signer 1.3

✅ Remediation

The RHTAS Policy Controller Operator is Helm-based operator for deploying and managing instances of the Sigstore Policy Controller on OpenShift. It is a self-managed on-premise deployment of the Policy Controller Helm Charts available at https://github.com/sigstore/helm-charts/tree/main/charts/policy-controller Platform Engineers, Software Developers and Security Professionals may use the RHTAS Policy Controller Operator to enforce policies on OCP clusters by using supply-chain metadata. For details on using the RHTAS Policy Controller Operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (6)