RHSA-2026:54757HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security advisory

Published
August 13, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (24)

CVE-2026-25679 →CVE-2026-27145 →CVE-2026-32280 →CVE-2026-34881 →CVE-2026-39821 →CVE-2026-42789 →CVE-2025-65073 →CVE-2026-24708 →CVE-2026-32281 →CVE-2026-32282 →CVE-2026-32283 →CVE-2026-33186 →CVE-2026-33413 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-23490 →CVE-2026-27137 →CVE-2026-33551 →CVE-2026-33810 →CVE-2026-42790 →CVE-2025-61726 →CVE-2026-33811 →CVE-2026-43001 →CVE-2026-44393 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-65073 — openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-23490 — pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID CVE-2026-24708 — openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33413 — etcd: etcd: Authorization bypass allows information disclosure and denial of service CVE-2026-33551 — openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-34881 — openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42789 — erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation CVE-2026-42790 — erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing CVE-2026-43001 — OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation CVE-2026-44393 — oslo.messaging: openstack: OpenStack oslo.messaging: Man-in-the-middle attack via improper TLS hostname verification

🎯 Affected products166

  • Red Hat OpenStack Platform 16.2
  • collectd-sensubility-0:0.2.1-1.1.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • collectd-sensubility-0:0.2.1-1.1.el8ost.src as a component of Red Hat OpenStack Platform 16.2
  • collectd-sensubility-0:0.2.1-1.1.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • collectd-sensubility-debuginfo-0:0.2.1-1.1.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • collectd-sensubility-debuginfo-0:0.2.1-1.1.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-0:23.3.4.18-2.el8ost.src as a component of Red Hat OpenStack Platform 16.2
  • erlang-asn1-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-asn1-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-asn1-debuginfo-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-asn1-debuginfo-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-compiler-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-compiler-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-crypto-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-crypto-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-crypto-debuginfo-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-crypto-debuginfo-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-debuginfo-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-debuginfo-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-debugsource-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-debugsource-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-eldap-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-eldap-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-erl_interface-debuginfo-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-erl_interface-debuginfo-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-erts-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-erts-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-erts-debuginfo-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • erlang-erts-debuginfo-0:23.3.4.18-2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • erlang-hipe-0:23.3.4.18-2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • +136 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Restrict network access to etcd server ports to ensure only trusted components can establish connections. Implement strong client identity at the transport layer, such as mTLS, with tightly scoped client certificate distribution. This will limit unauthorized access to etcd functions. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Ensure all TLS certificates used in the deployment include Subject Alternative Name (SAN) extensions with the appropriate DNS entries. Certificates relying solely on the CommonName (CN) field for hostname identification are susceptible to this bypass. For Erlang applications, the verify_fun option in the ssl module can be configured to reject peer certificates missing the subjectAltName extension. Workaround: To reduce exposure, ensure that OpenStack application credentials are created with the most restrictive scope possible, limiting their permissions to only what is essential for their intended function. If EC2 credentials are not actively used within your OpenStack deployment, consider disabling the EC2 credential API endpoint in Keystone to prevent unauthorized creation of cross-project EC2 credentials. Refer to the OpenStack Keystone administration guide for detailed instructions on managing application credential scopes and disabling API endpoints. Any changes to Keystone configuration may require a service restart to take effect. Workaround: To mitigate the risk of man-in-the-middle attacks, restrict network access to the RabbitMQ message broker. Configure firewall rules to permit inbound connections to the RabbitMQ port (typically 5672 or 5671 for AMQPS) only from authorized hosts and services within the control plane. This operational measure reduces the exposure to attackers attempting to intercept and impersonate the broker.

🔗 References (28)