RHSA-2026:5110HighCVSS 7.5

Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update

Published
March 19, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (7)

CVE-2026-27137 →CVE-2026-27571 →CVE-2025-61726 →CVE-2025-61728 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-25679 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27571 — nats-server: WebSockets pre-auth memory DoS

🎯 Affected products22

  • Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:1e950fd906277c3bafaffa140dc387b14d07d2a818c18638b98d03c21cb618fd_s390x as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:64543029a7895652884f31bc0d94cd39868617b1c47bb5cae5e5fa23689e4480_arm64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9850fe55e07917fc01f1562f3e4ba555c7c1a7ee9bc93edb3ec6e47b45671163_ppc64le as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:a57734fe379ec378107c03068b4fce04ae186656352c810b5db2b91bf8ca1eb1_amd64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7a5453ebb841bfcaae1b15c823a6ca2e4714d4028a457d5687d412ee568c2062_ppc64le as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cc48d9258a74255d7b46dbba8550a224fa97dc5f5fe095093d6e72e1a22a8461_s390x as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d28a834892e0339001e0c414ad1eb697a9d822e5638b8422ae6f2950036bb858_amd64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f8d74fced944874bb10872332c1fb3884b03cb68449ffad4bb8633d70e700745_arm64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:0f39666f8f6365d09cd0716348344adb091fa47171810fbf821088b5a12978fd_s390x as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a10ba2206c5d95f2df3e198ddc002ee354272e8660acb4ea68797083f35dba6d_ppc64le as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:adfa7c9d11670bf55289595d6d21124741586c1116e3f5427a5fd350e140d094_amd64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:c045f9b0e496240b907d0ba572fc1bbd0a12e1510115ff1884e3a7226206500c_arm64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:4a587f8153ff2a466414fb69e288f754da2b9f43154ba1ede5e9493a6d43c587_amd64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:574a52d17bd38da7882a32dedbb991ce81b5a67b8fdffe68e51ca477f790d0e1_amd64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b8c5202df848f0b13960183434c382ae188ed2fa728bc5437e47622ec948c443_s390x as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bace0a9040688db829cccfd83579e0a88ab08991b2ff6dc1064af72a14d5b2f7_arm64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d13900e0094bac295a523436594d568101888ab10732c297c4ab01ad92d5a296_ppc64le as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:01162aa8ce5c48b47301fd4c9a6835fda1b36358804c3ad50a5230fd151d2916_ppc64le as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:32009013a53f53faeb9107e06f8c654cdaaaa1233bcecdee290e9592df77b968_s390x as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:84eb26e40548fbeba8e3b0a85dd167d74c2cdc0909523d25e4942fe22e77eebb_arm64 as a component of Red Hat multicluster global hub 1.5.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:ecb1b97101f371f6159e3ca2eecb8be0fb04019ce379e5cc7936c146150cc36c_amd64 as a component of Red Hat multicluster global hub 1.5.0

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)