RHSA-2026:54274HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.8.1 security update

Published
August 12, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (9)

CVE-2026-33814 →CVE-2026-39883 →CVE-2026-42499 →CVE-2026-33811 →CVE-2026-39820 →CVE-2026-39821 →CVE-2026-25681 →CVE-2026-27136 →CVE-2026-33186 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39883 — github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing

🎯 Affected products6

  • Red Hat OpenShift Workload Availability 0.8
  • registry.redhat.io/workload-availability/fence-agents-remediation-operator-bundle@sha256:f722fd012aa6bad3c185baa5644bb8087745e04d37a34b925a38575941cff096_amd64 as a component of Red Hat OpenShift Workload Availability 0.8
  • registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator@sha256:0e14357c479ca1da780332572ed85f541c5788fde4023358fc67582a442b7323_ppc64le as a component of Red Hat OpenShift Workload Availability 0.8
  • registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator@sha256:402c93a3cd63e51b3fcadc4bf2491f73063fc15b1332a2475c23511b12416f00_s390x as a component of Red Hat OpenShift Workload Availability 0.8
  • registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator@sha256:5b3a2a1711dd9c7659308766f28cc8897a8076e0fd729fdf5696395277b6a76b_amd64 as a component of Red Hat OpenShift Workload Availability 0.8
  • registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator@sha256:b9a555cb95c6a341759fee277a815c863c3f66d6a611984f9007434698e5ff58_arm64 as a component of Red Hat OpenShift Workload Availability 0.8

✅ Remediation

For more information on the RHWA 4.22-0 release, see https://docs.redhat.com/en/documentation/workload_availability_for_red_hat_openshift/4.22-0 Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.

🔗 References (12)