RHSA-2026:36625HighCVSS 8.8

Red Hat Security Advisory: RHACS 4.10.5 security and bug fix update

Published
July 8, 2026
Last Modified
September 11, 2026

🔗 CVE IDs covered (17)

CVE-2026-39830 →CVE-2026-39832 →CVE-2026-42499 →CVE-2026-9165 →CVE-2026-25681 →CVE-2026-39820 →CVE-2026-39828 →CVE-2026-39831 →CVE-2026-32280 →CVE-2026-33811 →CVE-2026-39829 →CVE-2026-46597 →CVE-2026-39835 →CVE-2026-42502 →CVE-2026-46625 →CVE-2026-53488 →CVE-2026-12143 →

📋 Description

CVE-2026-9165 — stackrox: stackrox: Unbounded GraphQL query depth allows authenticated denial of service CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-46625 — js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin

🎯 Affected products48

  • Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:05dd53e6127b9002119c9b45837f57a741aaee7675274f97bd23c85303b24c95_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:5b5d026bb7988e258bb10d548eae2ee330f84d30be79adee00cf2646968dbaeb_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:81e9b12f2153706baceb7c05154ecb69a6c9b225130e80d20a595a91f7bc8742_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:dc3c7562e7246813f0e75f63e01af32a95abb31efc3238f01ddcaa5df483b678_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:26d4969c21b234219e20ede1b3df08fdb1250f39239f8365978d6d0002668eee_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:4dae34a8dd2a3f84345fa73aa71b5d4c30629cce316973ec14e95cbcb6e249d6_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:74b47f404add83156bb601dd0b3284bf8d7e8de297f950ff00b5f18fb16c5c86_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:afeab885aca2c2b4a3794c1f342bb1c802616546709c11d2466fe664e0b0a5e5_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel8@sha256:1f4439c3f97d81af59c66d0e9b4664925ca256ebf5cc14bedf21003b6fe30b2d_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel8@sha256:41cd92ebb4492161a0a2d9cd9afe8ba2a587aa63ce4fdf43d9c5f1e8705ac0e9_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:065e6e08945d72964d3b73022b8a6cdaed69ac283cdd7ae462bfd54d835ecb79_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:5b958f96a409088346cc452d16cff16f1ed0d11f28a1443449badc5081bedc69_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:85f541d097073ced436033f3b28775941b75aaa64ac38e9377b874ff3690344b_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:fe461141cb449e05b18df94128ada9a2ee4b283e72455cd1b4360d7a2a57ba84_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:c77fd69d41cb6f1f2abd0099cb41758eadf4e96d7b1a979473232bd80788b1e4_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:42ff0f634c6a3e4785ebcc9d08e792bdc86bcf53a5f1cadc915a2b02b393a197_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:a0642aac46c7f16bdf83827086151f23b0e23880b316f710bdd2f5d09eae5e46_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:c5dcb00a4e0d0966b2438e427933963f3a25c3e84aeb9897c620a6cc0ad055af_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:c8c8dbdda50c4db77f0ea2d011933badf07a8e7318c5b6a29b352fc342ce55f6_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:223bf9ac4c07796f59dfe5b5b4da73d755b6ae121c48514d9684ba1b65785630_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:49159080ea7587469f0ad688f9b53d5b5f8e028006031d0371eca9a03d401e3c_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:646bde20707db278d3e33a6dfad485699d0b3b9445d894d487a373cb3d56bdcb_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:f8457cf58c1a2b220a033b7b324cbb9f2173e10f8a32c35ff802fbdbadcd50bc_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:8cf28b9b4d7d9ebc615bd5f20630043abe461b4d047162a92287711c3822eee9_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:9f15ca532778d22bd840bb5b51ee8548c8a3fa991097e8d71899d1537b4c8387_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:eba8efa8ec40900d549d5e8071bf24ab41afcafb11b4c17d67c494c8c9f435a0_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:f4a75a14e1d78a9d4fbcda5ea214395e66938a313cb1a07dd39808866992a594_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:5a90532680985ba06e52625661ff66045dbdae81c4193103ef09a9eab051acf5_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:86d8078be89cae8446bb15822cc16957aa7dce2c67425e6117df393480af3e41_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • +18 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: There is no complete mitigation other than installing the update once available. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.

🔗 References (21)