RHSA-2026:5394HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 director Operator container images

Published
March 23, 2026
Last Modified
September 4, 2026

🔗 CVE IDs covered (4)

CVE-2025-58183 →CVE-2025-61726 →CVE-2025-61729 →CVE-2025-68121 →

📋 Description

CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🎯 Affected products5

  • Red Hat OpenStack Platform 17.1
  • registry.redhat.io/rhosp-rhel9/osp-director-agent@sha256:104de5ab607f2da597f8671bbb873e45c7d7c0ececa370f585841022a924aa5c_amd64 as a component of Red Hat OpenStack Platform 17.1
  • registry.redhat.io/rhosp-rhel9/osp-director-downloader@sha256:dfdc74ce40312f0452b1c88bad6af9501791478ca7e993dc9be08bf80c9df7b6_amd64 as a component of Red Hat OpenStack Platform 17.1
  • registry.redhat.io/rhosp-rhel9/osp-director-operator-bundle@sha256:9e6062e860439d2153e9d5cab6d53fab1eef32b8c1f5bdfb89da9e90bac24757_amd64 as a component of Red Hat OpenStack Platform 17.1
  • registry.redhat.io/rhosp-rhel9/osp-director-operator@sha256:6c43dc4baff26701f0e818eecd3ee0d85113cb894b0cfc0ddf5bd23bdbfeb9a3_amd64 as a component of Red Hat OpenStack Platform 17.1

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io or registry.access.redhat.com using the 'podman pull' command. For more information about the images, search the image name in the Red Hat Ecosystem Catalog. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (8)