RHSA-2026:33531HighCVSS 8.2
Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.4.1 enhancement update
🔗 CVE IDs covered (2)
📋 Description
CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-46595 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
🎯 Affected products8
- Red Hat Enterprise Linux AI 3.4
- registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9@sha256:a1490afc82c9994b52ee33e6d9c59665a19af7ef200e8832c26697b3e135fb16_amd64 as a component of Red Hat Enterprise Linux AI 3.4
- registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9@sha256:a632130e46e23eb70218c6f179db44b6b2a04c02cd1605beb6430feba2c90215_amd64 as a component of Red Hat Enterprise Linux AI 3.4
- registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9@sha256:217191b7b6934dfc60db92c4c2bdba8016448ce12403fef45c6125693ed9e078_amd64 as a component of Red Hat Enterprise Linux AI 3.4
- registry.redhat.io/rhelai3/bootc-cuda-rhel9@sha256:5cff37d6a84463abb9a99fbb4be645c99a8e6b588a8c8d1bc60900d609538018_arm64 as a component of Red Hat Enterprise Linux AI 3.4
- registry.redhat.io/rhelai3/bootc-cuda-rhel9@sha256:805304826cbb494aba7a923a54b4f02ccbc5532b52bddb37d4bc66ed0ccab6cf_amd64 as a component of Red Hat Enterprise Linux AI 3.4
- registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9@sha256:1061cfa644cddf53ffe92bbf1bb38bf5fdcc8d7ad33702f429791ab8fad1c1e2_amd64 as a component of Red Hat Enterprise Linux AI 3.4
- registry.redhat.io/rhelai3/bootc-rocm-rhel9@sha256:dc7589a44bec51206c0e649ce6cce9a6ad046e9df686686d3cdc3399a558f63e_amd64 as a component of Red Hat Enterprise Linux AI 3.4
✅ Remediation
The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.4 Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.
🔗 References (7)
- selfhttps://access.redhat.com/errata/RHSA-2026:33531
- externalhttps://access.redhat.com/security/cve/CVE-2026-39821
- externalhttps://access.redhat.com/security/cve/CVE-2026-46595
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.4/html/release_notes/rhelai-34-stable-release-notes_release-notes
- externalhttps://www.redhat.com/en/technologies/linux-platforms/enterprise-linux/ai
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33531.json