RHSA-2026:54287HighCVSS 8.2

Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.12.1 security update

Published
August 12, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (7)

CVE-2026-25681 →CVE-2026-27136 →CVE-2026-33811 →CVE-2026-33814 →CVE-2026-39820 →CVE-2026-39821 →CVE-2026-42499 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing

🎯 Affected products14

  • Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-healthcheck-must-gather-rhel9@sha256:07a04832975f5740a8d36db33e304d34f4e38a870788de05112a5c31505d148e_amd64 as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-healthcheck-must-gather-rhel9@sha256:b5355c3c85d9e34f22a46bb3f190bd2bfcb4f27109858010c80539c6fbeccdbe_s390x as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-healthcheck-must-gather-rhel9@sha256:b906c8de5f631902847740e7ac105b74c80ab488868fde7d750dff5881ea8e5d_arm64 as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-healthcheck-must-gather-rhel9@sha256:ee2f7805d99ed025739bf2187649f0171c263baa0d844fe652d68b441d6dcd79_ppc64le as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-healthcheck-operator-bundle@sha256:4214978132ffd6f9d840e2be8df4e9b85cf13d2740ba4f82fbe72f3d93d6dee5_amd64 as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:6ece0ac34989350e9be7613fc533767af9ad7bf9544bad6ad297dcece2b6ca64_amd64 as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:82081eb65c0d359b5d4895e72ef21955a7703a533d2a39a74e0084d398807a45_arm64 as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:ae120a374dbc2935cd270351ead5a944e84fb305c704df8f41d72e32d69fbd97_ppc64le as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:d548561809fc5d0423fa4dfde0a906b986170f16262c47077e1a6e6889c5d5a5_s390x as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-remediation-console-rhel9@sha256:0b237c4474bb9a64a70308f35a0645fecb20efa27d63e706b27ca091d255b311_s390x as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-remediation-console-rhel9@sha256:2ed8b109c7ffb6821590ec0b554f894b7c714c1b9632be260818f7178daf7baa_arm64 as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-remediation-console-rhel9@sha256:5e0f6c04a44a3050869c00524f214bfd72ca34aadbf71b80f0d12cc3022d4f2b_ppc64le as a component of Red Hat OpenShift Workload Availability 0.12
  • registry.redhat.io/workload-availability/node-remediation-console-rhel9@sha256:dbdf7d0d139bdd2661a486493805540cd6e9277aaadbde7a1414ccdc157a20e5_amd64 as a component of Red Hat OpenShift Workload Availability 0.12

✅ Remediation

For more information on the RHWA 4.22-0 release, see https://docs.redhat.com/en/documentation/workload_availability_for_red_hat_openshift/4.22-0 Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.

🔗 References (10)