RHSA-2026:43692HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

Published
July 22, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (34)

CVE-2026-25680 →CVE-2026-39826 →CVE-2026-39833 →CVE-2026-39835 →CVE-2025-58181 →CVE-2026-39821 →CVE-2026-39828 →CVE-2026-42499 →CVE-2026-46597 →CVE-2026-39817 →CVE-2026-39827 →CVE-2026-39829 →CVE-2026-39830 →CVE-2026-39831 →CVE-2026-39832 →CVE-2025-47913 →CVE-2026-27136 →CVE-2026-39834 →CVE-2026-25681 →CVE-2026-33814 →CVE-2026-39820 →CVE-2026-39823 →CVE-2026-42506 →CVE-2026-42508 →CVE-2026-46595 →CVE-2025-47911 →CVE-2025-58190 →CVE-2026-33186 →CVE-2026-33811 →CVE-2026-39825 →CVE-2026-40356 →CVE-2026-42502 →CVE-2025-47914 →CVE-2026-46598 →

📋 Description

CVE-2025-47911 — golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-47914 — golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages CVE-2025-58181 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication CVE-2025-58190 — golang.org/x/net/html: Infinite parsing loop in golang.org/x/net CVE-2026-25680 — golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39817 — cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39823 — html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content CVE-2026-39825 — net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls CVE-2026-39826 — html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping CVE-2026-39827 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-39833 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-40356 — krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-42506 — golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing CVE-2026-42508 — golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey CVE-2026-46595 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-46598 — golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input

🎯 Affected products71

  • OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 as a component of OpenShift API for Data Protection 1.6
  • +41 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse untrusted HTML content, or enforce timeouts on HTML parsing operations. Applications that do not parse arbitrary HTML are not affected. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Ensure that user-supplied URLs are validated and sanitized before being passed to Go's `html/template` package for rendering in HTML meta tag content attributes. Avoid rendering untrusted URL data directly in meta tag content attributes. Workaround: Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy's Rewrite or Director function for security filtering. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Update affected Go applications to use golang.org/x/crypto version 0.52.0 or later, which rejects unsupported ConfirmBeforeUse keys instead of silently ignoring the constraint. As a workaround, do not add keys with ConfirmBeforeUse to the in-memory keyring from golang.org/x/crypto/ssh/agent, or use an SSH agent implementation that correctly enforces confirm-before-use. Workaround: To mitigate this issue, ensure that the NegoEx mechanism is not registered in the `/etc/gss/mech` configuration file. Removing the corresponding entry from this file will prevent the vulnerable code path from being activated. This action may impact services that rely on the NegoEx GSS-API mechanism. A restart of affected Kerberos-dependent services may be required for the change to take effect. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse and re-render untrusted HTML content. Applications that do not parse arbitrary HTML are not affected. Workaround: To mitigate this issue, restrict the exposure of the SSH agent to untrusted sources. Avoid enabling SSH agent forwarding when connecting to untrusted hosts or environments. Ensure that applications interacting with `golang.org/x/crypto/ssh/agent` validate all inputs to prevent malformed data from being processed. Reloading or restarting SSH services may be required for changes to take effect.

🔗 References (38)