RHSA-2026:36319HighCVSS 8.8

Red Hat Security Advisory: RHACS 4.9.9 security and bug fix update

Published
July 7, 2026
Last Modified
September 11, 2026

🔗 CVE IDs covered (18)

CVE-2026-32281 →CVE-2026-25679 →CVE-2026-39828 →CVE-2026-39829 →CVE-2026-46597 →CVE-2026-9165 →CVE-2026-12143 →CVE-2026-32280 →CVE-2026-33811 →CVE-2026-39820 →CVE-2026-39831 →CVE-2026-42499 →CVE-2026-25681 →CVE-2026-39830 →CVE-2026-39832 →CVE-2026-39835 →CVE-2026-42502 →CVE-2026-53488 →

📋 Description

CVE-2026-9165 — stackrox: stackrox: Unbounded GraphQL query depth allows authenticated denial of service CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin

🎯 Affected products46

  • Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:42ce9a730012343eec85c5b69eb163311580df4682de47ca435043dff92c2dda_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:6204d3577ee741f812133ff2d88499c807aa3ad58432f3304c1a35fc112189fd_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:d68367f3f9e3e785b7cfbd1d03e7c9ddbf8aed846fd7ff2d0ac03413c63e51e1_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:fbc7d9fa8d47d71146098bdbcf2932684466d48df2a9e71eb19e3bbe185eaa3c_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:13b23d3626a7c286bc04db231b9c826914c03c4c7a8bebf031d973ac03a8fc31_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:7d8340d149a12f7340ba43a87d6df208eb607a0f579b25efd1360bbe3aafb2e5_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:ce31d01779b4a6e31d3ccc4aa50da2d5c5c40e01ed9d40327da6c41c0a486a2b_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:ef34f9f1927d68839bf1433f6a2c4753edbaa7bc1df54ac491643a4687aac2bf_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:48f1df601e96894b983b79cda2c10e1706b21056a3637b92a4b0e0c1f4cf0a19_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:a757f885d03f92b46077f763a2e3695428efca08d1d170a850f6f35112f66416_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:ac4aeacd669e6acd8b6513ed2e2d7bf065c7dc5e7b94ad4fa6287babab054d14_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:c11dd07b70d80f5705d62fdf5a0df3b20ef5bc124ed0ebb17d63e475a3970635_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:8580ba5ee1456d0def514182dbcd5b9d131e82c9e79a51ef1a44002891b1b3a0_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:2f654cd657b76268e96f48c805d98b6a01193d5472e3b770d8e76d79b5c05f3f_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:934b313047a61e8f78e1a8b17083c4b5ad85f658f1314993e36710ae5e525595_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:96c38c3f664be6d572f4c267861008387d72e4a51e9d3f6eb9c90dab0ff3dbdc_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:a2a01dc772b7343f80be6f0df86143abbbddac487d39ff9dca91248879cfae3c_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:4333f349152fd58df6e05ebe890c360bea2cf6d09c38b51cc4b0628132f85438_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:a0d6f0dba57d06ba8d1ba7e5527fac907ecfcabab5ed1df0af3e664f5f831709_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:d58d334c4ac8b3ec12c25dda7bc0c54aa463f5c6ad072d019deb4bef0e4e0388_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:edd5d70d99d538af0d2e4e8af795670f9bf75db5f33d5916d8fe2338ad783f69_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:3d1ad6886063f535a79ac17e37aa000255d7e609e964256e90a7105393f99524_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:9b22d40703ae9073ce13aa8b50a2cac2976ec7641977a8a7b8c3a0c5b4c89e69_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:9df1184a0d86761b2f9fe173a446da819c89b95fd4e7759fc13b8f6fd6d563b1_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ac2c3fa4bb41c9f5e6d6f8cc400a250206923a3d74d72c52d7c30664baabcaaf_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:597c40e984b4e6c8b39fd07e95116b33050c0119c8064e84ab32966db2b4c28f_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:6030687a0992fe6c2bf15e4455aa0601061423fb20a0153b753712ec4c8b6b8e_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8fee28cec9066005086a5e9d2b77ec5b351463dd268f5a09176ee0b47ba7c09d_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:c8aa39c7c288e4ad2813b2cea30826c99c3e8e25cc1d43b9d3e5b5a95a663d56_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • +16 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: There is no complete mitigation other than installing the update once available. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.

🔗 References (22)