RHSA-2026:4270HighCVSS 7.5

Red Hat Security Advisory: OpenShift Source To Image 1.6.0

Published
March 11, 2026
Last Modified
September 4, 2026

🔗 CVE IDs covered (3)

CVE-2025-61726 →CVE-2025-61729 →CVE-2025-68121 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🎯 Affected products9

  • OpenShift Developer Tools and Services 1.6.0
  • registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:80e249e039ca97506b111c12739d2d5020237e3afb8fe1cc5014a803d917d1f1_ppc64le as a component of OpenShift Developer Tools and Services 1.6.0
  • registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:d95a6e017fd2230836b321a18e9be574776ca218f19386c35bf846f2af7920ad_arm64 as a component of OpenShift Developer Tools and Services 1.6.0
  • registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:e972d72ec52877e59b162099d20d60a83f0607ecf724720b6163b48141deb67a_s390x as a component of OpenShift Developer Tools and Services 1.6.0
  • registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f0b6590d7f5168a7dc749138a935d094369a7b87bbbb8b9d1c755fc01d57100e_amd64 as a component of OpenShift Developer Tools and Services 1.6.0
  • registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:706a7e97fc435cc175679eabed85a3f6a379cc0a4111a11e592758ccfdfd2857_arm64 as a component of OpenShift Developer Tools and Services 1.6.0
  • registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:7554ecfe28d55d03c9814a2591c337bed1aaf203d644c02595cef517623b7cb7_ppc64le as a component of OpenShift Developer Tools and Services 1.6.0
  • registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:ed3d74c2255ed6f3d358582794beae8091ecc098eae4a3c7c1b1ced59011210c_s390x as a component of OpenShift Developer Tools and Services 1.6.0
  • registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fe8de6cf5d30af29e64e5f9ebe348b4ce6ff838be480d81795723a8642e19134_amd64 as a component of OpenShift Developer Tools and Services 1.6.0

✅ Remediation

It is recommended that existing users of OpenShift Source To Image upgrade to v1.6.0 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (6)