RHSA-2026:62866HighCVSS 8.3

Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-3 This version is a rebuild of 2.19.0 using a newer base image, Go modules and Go compiler, and two bug fixes. See the release notes for more information.

Published
September 2, 2026
Last Modified
September 19, 2026

🔗 CVE IDs covered (10)

CVE-2026-33818 →CVE-2026-56852 →CVE-2026-56853 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-56862 →CVE-2025-61729 →CVE-2026-33816 →CVE-2026-56860 →CVE-2026-79921 →

📋 Description

CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-79921 — github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads

🎯 Affected products30

  • Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:776ccfd7e62dfc93fa7ddefc601ae2c098d764f2b105baea9f6725cd400f2575_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:b4d4aa416bc1bfe229db414f7826d9098182adf8f746484c6c087a572802a826_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:c213a69dcc6714669cf09b029947ddd2eb28f2c7af0c1f871d67364be32181f4_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:d8e4a1941904a39c6d5b8eee26b620d6f8bb8344eda5c918c3dbbbbd8bae3725_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:46569a7c19b13a9b8d3ec3ee468164ecd232869ea71bc8eea2b495a292eb66a3_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:4c7042663ab7418348806dfd06e8b42ad65c1583c32bd41914af1afa3e0f8062_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:dd3e631747ba16ba9257970cd342c632b0f622aca8af56fc13b2383515b96ab6_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:f2dbc3113b90b179f2ecbfb7755001b01d34eaecc372dd6caaa7694426e6b36a_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9@sha256:4c7b35efdc6ebeb90a8cbd30c137548a4d64e3a593c300f4a5905aae5591c83e_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9@sha256:ab76c3089a31ab1e8784636aa1fd451091d6f7e776e01063c8f62b6108acf179_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9@sha256:c107018f7d19857dd0941281741b53e4eeee107cbe4f67124ecd9427aa6cfbf0_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9@sha256:ca76f4df368a53fc2dc7e97948e9488e23367fecc64aba86319a9a669195e610_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9@sha256:1e9d0fcb74a58c0a33b1e862b791c85ef5764808fc1bdcf9bde070abbee0c7b9_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9@sha256:2e81ec1fa7102fb54db5d86f7493e45a8d0a58097a7892a2847f27ea376957fa_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9@sha256:49364193886807ddf99e95ce3b6824cbd5a8ac5f516abaa07ca38b83a92433fa_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9@sha256:9614cb3ffda518dfccdd8c9bb03df9ae1d1849d0e16829f9ac144f81fd875280_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9@sha256:3abb2eb797e1017ec61c350b1e3cc93dc0a457be6789d6b8c50ba0d5a8162bd8_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9@sha256:44955414f163d697a3de82d7518ec0e8e7cc39924e6031ed4dae2103cfda060c_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9@sha256:8835b36ba6c35ed7069a2aa1d97f52aac3c1514ead46e190261508598581032c_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9@sha256:cb683793064ed76df19f718b05687025f82b2d6df119b713f25ea02e0c0bfa90_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle@sha256:2d3901de438bcba37e25201fb302d34537c999e41a73ac2f2e7d00dba8871428_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:767137e6a40a658b567a49dbf9912f57075563f9e49c4aa0b12f18ae6d704626_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:a85f23417358ade78710384ffbd013e4a2adc705d827d3f1a00902ea817a551c_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:bbce12ccd439220123760c73edb13c2576f5f16265ed52a8e35c5fb76064807e_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:e3a75a80c7e2635255ee26a9a5581e263ea5218dff00c389676281ea29fe27f0_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:3fe9f57c14342d11572a7363947c94c94e52124ae9bc268df562afcae83aa08a_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:5042f9e6e3bbdea5655fbc530d3d8b042cd90dc55a2af45409b9fca4c7cf26d2_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:78c952fa4c0cfc7b8ee84a0b03e71e1b0feed6899ffd3e9042e93bc1f5d9e7db_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:c6de28cabb883534b2ddd95a6f6df6aac35098781e2910d5875070cdd477bcdc_ppc64le as a component of Custom Metric Autoscaler 2.19

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (24)