RHSA-2026:4170HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

Published
March 10, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (3)

CVE-2025-61726 →CVE-2025-61728 →CVE-2025-68121 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🎯 Affected products46

  • OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:268e73e691f41b0a12b93c03a38c042b788a8b25119d03d43e966058a98dd1dd_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:52ea2f66223a172c31513572c1c8cd65532bf790eab02eb6e5d587b131c0c474_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:de2b9acd6ce2e487fed18bc6634eecbe5aaa76ca5e2907c9d22228a386c1a04e_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:eae057bec74ac61b9d052ad765492fa607498ef5b7e1d7e2e607665b228298e4_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07e2b1b186f3feaa6b0048f6788fbb053711a885a046d5a17a39a3fbc37b3f01_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:9c03c4133e4a280b65da5adbe1b70c1d2f585419f597a10f7086e700210791dc_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:afb537839347b55db4cbc3757f0e47afd0faf98bf26649d1af4117bba7a39b72_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:ff8450d4b8f40e33ae544449407399c7204b768349234f1438c7ec533602e664_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:17a4a6040bc7ad24bd0a6445f9eb97ca94f438b4302e715f103d30f73983fd00_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:6833f09d69c8d60990fed4c282e23dc45cf9fb93fc7102b9cf736244a2895b45_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:82e54c9f5d8e4706aebf6f938a5d0a2c2a2cfc3bed571a10ec461bd2a48e2e60_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b7aa2b4bf922452334c890e2ce56ad535eebbd2dc20637702a3d4097dc2007a8_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:75ef60f6723db723b81ffe52ef55062476fb65d53d3b65fd959c8210ebaaf713_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e98d2a0eb2d31736814d06c80e9501610ce33fe959a4204a768cabb64c89dbf_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:bb6c1337b03d7b92f722c87e77fea069df70c97775744cb7afa53b97aa672ac8_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:f3385c6b788ce0b0d2c5b99561386078d4206bde7a13a615602aab82d411b915_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-operator-bundle@sha256:8149c664c680df2561593e16a2c6442a73711a87659789f0fef55133ed984642_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:55fce6251931f9e7064bf1072462e9bb76268bf2cfbe62d3721b5b18c7edf84a_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6f8bba07f297d75b1d42b6011b438b3626857c892c94dab3d54c2cf51a928b81_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:7b7728404ab31e4cb56b9eccf979077291da19116d9019e561ce1349f08c30d2_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:e25471ee7dc5a107f6c08f84415845cd4d61297448d2ce3753a60f39a29bcd57_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:168db9b96fd91c830fa322eddff7739a8dd2a0be2a9f5891ed2ca8525e5da15e_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:335ffb6ae1b33cdb837982441715bcf829b539cb62f8e7a40561d76e6f491f6e_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:a144158b0697990dc354ebf4ef7eb7da7f7643e2718e14126df2c6cfba6fc202_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cf524ae1652b6ca6372da35af44a4af46129fdab2d368e6c476ef6c4e8f85cff_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:0214fcc58fedd15e6415d2ed24886c7e31d530adea063a0751dee84ff785d8fa_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2b4808ab800751c4c4714d238c97a0c9419e62208ac68abac5942148471874b8_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:8a2b001d37e86bfe305ef69d36099df1fd81e151f9f258a5337605696ef4046a_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:ee5f48c276145a6de3baa0fd3a754189f0dbacaaeda05b6b0bcc05de6502f5e2_ppc64le as a component of OpenShift API for Data Protection 1.5
  • +16 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.

🔗 References (7)