RHSA-2026:54283HighCVSS 8.2

Red Hat Security Advisory: Red Hat OpenShift Workload Availability v5.7.1 security update

Published
August 12, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (7)

CVE-2026-27136 →CVE-2026-33811 →CVE-2026-33814 →CVE-2026-39820 →CVE-2026-39821 →CVE-2026-42499 →CVE-2026-25681 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing

🎯 Affected products6

  • Red Hat OpenShift Workload Availability 5.7
  • registry.redhat.io/workload-availability/node-maintenance-operator-bundle@sha256:5d9fa0808c900246ef05e51d6de29c48c201c6e8b2e9cdec0f895ecb6ad26c03_amd64 as a component of Red Hat OpenShift Workload Availability 5.7
  • registry.redhat.io/workload-availability/node-maintenance-rhel9-operator@sha256:4f8991fd01de2e5a7e1fd67b4ae76c5ec8e2d39d49a315b770b1515cc959e83d_s390x as a component of Red Hat OpenShift Workload Availability 5.7
  • registry.redhat.io/workload-availability/node-maintenance-rhel9-operator@sha256:62f4b3e9b23ff60d3b955c395b5c87d4155fa307d076df7a3b1070e06096bb57_arm64 as a component of Red Hat OpenShift Workload Availability 5.7
  • registry.redhat.io/workload-availability/node-maintenance-rhel9-operator@sha256:67e3d07fe82432bc0c016163c00b18d1f297f4b98c5fc7c80065404d240c5bfc_ppc64le as a component of Red Hat OpenShift Workload Availability 5.7
  • registry.redhat.io/workload-availability/node-maintenance-rhel9-operator@sha256:7c5a1e475fed819b8c9eac40640f7d9a6dd9ac80f8ddbc5b9bd60dc3efa2ee25_amd64 as a component of Red Hat OpenShift Workload Availability 5.7

✅ Remediation

For more information on the RHWA 4.22-0 release, see https://docs.redhat.com/en/documentation/workload_availability_for_red_hat_openshift/4.22-0 Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.

🔗 References (10)