RHSA-2026:36808HighCVSS 8.8

Red Hat Security Advisory: DevWorkspace Operator 0.42.0 release.

Published
July 8, 2026
Last Modified
September 28, 2026

🔗 CVE IDs covered (7)

CVE-2026-39830 →CVE-2026-42508 →CVE-2026-46595 →CVE-2026-32281 →CVE-2026-39821 →CVE-2026-39828 →CVE-2026-39829 →

📋 Description

CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-42508 — golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey CVE-2026-46595 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation

🎯 Affected products14

  • DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:2a263321d0db82af2c030c7035349d3b42378fb3b03c3e58c0553ce68217581b_amd64 as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:2a99aac71cd2c5ac53e26817eb8e1df65e417ebbc0fce30b05905f022df9dda3_arm64 as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:509841df7c98e3d55c85e44dce9d1b235ab9ad80fa0ec82fdfc9a3562e4effbf_s390x as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:77e0a72e35af25a60b202082ada3e61d80d0be7e24ea3b0c374541c93d25da44_ppc64le as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:f1d6822065c055040bf9017047ea4afd874c33ccbfa3c4e5854655419f58dd8e_amd64 as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:00c7568ee3e388839b7777dab379ac6ecf3c5bc7bdeec2562417f88f862b80b5_s390x as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:0ba88226a4c28d5caab277cbddac90e8782bd9b77a87c2253b5933730fda57f2_amd64 as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:3d0cf855d29d897af3f55066f0882b844402d43c29ede0401336e00d8e09806e_ppc64le as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:70d9351eb4156abab69dd5001020cf9a90731d25a2677069c85788c6f41d2130_arm64 as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:273e029b1618235c7c4ea103d09da99dac8d2803c9be4b5754f1f251563fce27_amd64 as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:2f577d0458bb4af7eb00dc937cac08023c2de0fca74e31fc2c2725cc4cc26a44_s390x as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:71f0ecbb31045e41063e781e2cf03737e8878c49b27366103ff15b7a95e8e946_arm64 as a component of DevWorkspace Operator 0.42
  • registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:b74935a50eddbd0bfa65b9cd7546c73fadc9267f867adcdaa0cbf8c32b6b4e40_ppc64le as a component of DevWorkspace Operator 0.42

✅ Remediation

To start using the DevWorkspace Operator, install the DevWorkspace Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.

🔗 References (11)