RHSA-2026:54286HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.3.1 security update

Published
August 12, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (9)

CVE-2026-25681 →CVE-2026-27136 →CVE-2026-33814 →CVE-2026-39820 →CVE-2026-39821 →CVE-2026-42499 →CVE-2026-33186 →CVE-2026-33811 →CVE-2026-39883 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39883 — github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing

🎯 Affected products10

  • Red Hat OpenShift Workload Availability 0.3
  • registry.redhat.io/workload-availability/storage-based-remediation-agent-rhel9@sha256:615742b426e6685458a74d1d70542c2b6cacbddbc54579c57ea8722723214144_s390x as a component of Red Hat OpenShift Workload Availability 0.3
  • registry.redhat.io/workload-availability/storage-based-remediation-agent-rhel9@sha256:a135778609e2e6724cf2acdd147d42a4d42f098d6a02b383210705294e396e6f_arm64 as a component of Red Hat OpenShift Workload Availability 0.3
  • registry.redhat.io/workload-availability/storage-based-remediation-agent-rhel9@sha256:cf75a72c8b4ec1972529dd273879f989e40e12a05cdf6b04c23997c0940531c4_amd64 as a component of Red Hat OpenShift Workload Availability 0.3
  • registry.redhat.io/workload-availability/storage-based-remediation-agent-rhel9@sha256:ddccb1cd4cb2c76339790ea62da7b131be252b5cbc43c9f099c18f11680d7a36_ppc64le as a component of Red Hat OpenShift Workload Availability 0.3
  • registry.redhat.io/workload-availability/storage-based-remediation-operator-bundle@sha256:264d76e41258bd9c6b9b9b166a2201270953032f05f72cd53243d80b5297e8a4_amd64 as a component of Red Hat OpenShift Workload Availability 0.3
  • registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator@sha256:3721ffeb4a0ee48d815c562d21905d395fe72c3c0db0902a842f8da1d3dd4611_arm64 as a component of Red Hat OpenShift Workload Availability 0.3
  • registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator@sha256:50d682d3dcefeedb5d197bd9cabad1cab8e70b01312c91f74de039f0da823d07_amd64 as a component of Red Hat OpenShift Workload Availability 0.3
  • registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator@sha256:6928d66e8b19b71eacacfb755f73f4f8e349c086f9828d33508aa34eccc92394_s390x as a component of Red Hat OpenShift Workload Availability 0.3
  • registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator@sha256:7e1b666f19ef988fcfd97bbcee482c6494bf91ca712a0893027ac4f66da9111e_ppc64le as a component of Red Hat OpenShift Workload Availability 0.3

✅ Remediation

For more information on the RHWA 4.22-0 release, see https://docs.redhat.com/en/documentation/workload_availability_for_red_hat_openshift/4.22-0 Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.

🔗 References (12)