RHSA-2026:68335HighCVSS 8.2

Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update

Published
September 16, 2026
Last Modified
September 19, 2026

🔗 CVE IDs covered (12)

CVE-2026-44740 →CVE-2026-48050 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-56860 →CVE-2026-71556 →CVE-2026-27145 →CVE-2026-33818 →CVE-2026-41178 →CVE-2026-56852 →CVE-2026-56858 →CVE-2026-56862 →

📋 Description

CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-48050 — net/http/pprof: github.com/basekick-labs/arc: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

🎯 Affected products38

  • RHEM 1.2 for RHEL 10
  • RHEM 1.2 for RHEL 9
  • flightctl-0:1.2.1-1.el10.src as a component of RHEM 1.2 for RHEL 10
  • flightctl-0:1.2.1-1.el9.src as a component of RHEM 1.2 for RHEL 9
  • flightctl-agent-0:1.2.1-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-agent-0:1.2.1-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10
  • flightctl-agent-0:1.2.1-1.el10.s390x as a component of RHEM 1.2 for RHEL 10
  • flightctl-agent-0:1.2.1-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-agent-0:1.2.1-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-agent-0:1.2.1-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9
  • flightctl-agent-0:1.2.1-1.el9.s390x as a component of RHEM 1.2 for RHEL 9
  • flightctl-agent-0:1.2.1-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-cli-0:1.2.1-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-cli-0:1.2.1-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10
  • flightctl-cli-0:1.2.1-1.el10.s390x as a component of RHEM 1.2 for RHEL 10
  • flightctl-cli-0:1.2.1-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-cli-0:1.2.1-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-cli-0:1.2.1-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9
  • flightctl-cli-0:1.2.1-1.el9.s390x as a component of RHEM 1.2 for RHEL 9
  • flightctl-cli-0:1.2.1-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-observability-0:1.2.1-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-observability-0:1.2.1-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10
  • flightctl-observability-0:1.2.1-1.el10.s390x as a component of RHEM 1.2 for RHEL 10
  • flightctl-observability-0:1.2.1-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-observability-0:1.2.1-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-observability-0:1.2.1-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9
  • flightctl-observability-0:1.2.1-1.el9.s390x as a component of RHEM 1.2 for RHEL 9
  • flightctl-observability-0:1.2.1-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-selinux-0:1.2.1-1.el10.noarch as a component of RHEM 1.2 for RHEL 10
  • flightctl-selinux-0:1.2.1-1.el9.noarch as a component of RHEM 1.2 for RHEL 9
  • +8 more not shown

✅ Remediation

See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2 Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: No mitigation is required. Red Hat products do not ship or include the affected Arc component (github.com/basekick-labs/arc), so they are not exposed to this vulnerability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).

🔗 References (14)