RHSA-2026:5549HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Builds 1.6.4

Published
March 24, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (6)

CVE-2026-25679 →CVE-2026-27137 →CVE-2025-61726 →CVE-2025-61728 →CVE-2025-66471 →CVE-2025-68121 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509

🎯 Affected products38

  • Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:3e7802fd4777d02152c225bd23d99d3a67301ef7dcc4d86624dc0852905b89c0_amd64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:658118be2dd7dde63668822f2b10bf2155d1a7264435c31e9da01c4eed429a31_ppc64le as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:6ebecac905954551ee9e1d8ace2282305823528e5d81f430020390e6f0146733_arm64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:9f138971e0419cf08273b296c86770a6a8146e96b19f354df51141794cb2dc50_s390x as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:0c292a7860239fcaf9dc3b99ded7fb3bf35bb04e36419731012a407a055ce93a_ppc64le as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:84a60e844b90441a353b605ec9d893426a2cba422c45306090273a738b029242_arm64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:86dc4e5cb44e3e7519fa3fb4c994b2cc9204117a728c458b3994c8c6dfba372d_amd64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:9a0705a74dbf6f6dc4f202696462940aa8c21358c60678d8c06f39e438ee410d_s390x as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:6cad955d303121f214c9200fdded75a18c0ebca4d6676fc49fb82c06fc4790fc_ppc64le as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:933f790fe6a2652dde798dcb39e4daeb6ad2a3b371d3b4930ef4f016a70769ed_s390x as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:942b6a4d4299e09ba619144ee216cb5eea73dd8aea6117ae4cb92a82c026c76b_arm64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:e7607a6ca262ba1f9403d8a89e8f9771b84cac45e43eaee739789cf0cb8ebd29_amd64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:0a49e3ed4090ee01e433871ef2765d8c74813333f6a641f2edff6fd56ede8d76_s390x as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:21230f1cee5974dc459f4b31f829f942cf27d2b7adf081ade185f78b8554822f_ppc64le as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:7aaa6d41e175e70f6a96ee44ba47805987a818858a19517698ec564d2d4c6c61_arm64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:d3092e5ad323b1454a7ee54d54ff0aae0f5cb44603a93a80087768e984c917fc_amd64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-operator-bundle@sha256:b5a49391fd646c612bff8ee78e55f193f17141a3ef567eefdbaa21e9edaf4ed1_amd64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:846cfa73983011c3f351e0584ace035ad06713f78e625e351922c33c31fc35f6_s390x as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:a753821c3238712b53436e7689ed0bf6dde224aa9bbcca70c4018709e7391ff5_ppc64le as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:abc4ca39454ce581794f6e80b272878b1aa81636d84933de5de0035888d9e231_amd64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:ace068e3a65adc34ebba6a38242d4bb65e8cdd05c846daadfaa9e687e666b0bb_arm64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:0a3b22036310909533456be9c03ae6b7b3c5d91b89b245533925cfe81e523d9e_amd64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:d9a636edf9d0ea72339a6cf4af5d343f8ff0723cd466581a80968820405f9a15_s390x as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:e1489201089cda6b2b6dfe8b3b74bb4565030586de1ba18888727a5ddba4dea1_ppc64le as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:ea105c68e91862c8d0279240d9d92d1d27b816b49bbf528fb2d30a11343a24d8_arm64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:1cc18f61f97007488f929514f0d96e7ee799cbeb57c8040393510fb5df1308ea_arm64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:391eda856869508163773cf3d8f457bc27bae4619009abab4e1bc95c34013a80_amd64 as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:b623dd3f2f055038655d3ec62983d6bf7f519d4b2d010c89f2809870ab75c3ff_s390x as a component of Builds for Red Hat OpenShift 1.6.0
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:d6d1b43384c9532b4d5c0af85df5a6086b986494825216103c02bfe67ddb1f33_ppc64le as a component of Builds for Red Hat OpenShift 1.6.0
  • +8 more not shown

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Builds 1.6.3 upgrades to to 1.6.4 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)