RHSA-2026:54525HighCVSS 7.5

Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.1.1

Published
August 13, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (4)

CVE-2026-44740 →CVE-2026-56852 →CVE-2026-27145 →CVE-2026-39835 →

📋 Description

CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

🎯 Affected products5

  • external secrets operator for Red Hat OpenShift 1.1
  • registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64 as a component of external secrets operator for Red Hat OpenShift 1.1
  • registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x as a component of external secrets operator for Red Hat OpenShift 1.1
  • registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le as a component of external secrets operator for Red Hat OpenShift 1.1
  • registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64 as a component of external secrets operator for Red Hat OpenShift 1.1

✅ Remediation

Before installing the operator, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used while installing the external secrets operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+

🔗 References (8)