What is RHSA-2026:70392?

RHSA-2026:70392 is a security advisory published by Red Hat Product Security with High severity. Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.1 release.

Which CVE IDs does RHSA-2026:70392 cover?

RHSA-2026:70392 covers the following CVE IDs: CVE-2026-33818, CVE-2026-56853, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2026:70392?

RHSA-2026:70392 has a CVSS v3 base score of 7.5, published by Red Hat Product Security.

Which products are affected by RHSA-2026:70392?

RHSA-2026:70392 affects 5 products, including: Red Hat Web Terminal 1.14; registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:f29ddb20d3f133feacedfff8161478c88b69877441b73e07cd39dd8af39f4cde_amd64 as a component of Red Hat Web Terminal 1.14; registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:48330e9174b84c9d4c10b6f3d23dcfd593372eddd9d922331c0d2dbb9487a99c_amd64 as a component of Red Hat Web Terminal 1.14; registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:df4e707763fbb1d25ce5321422c11a642006e25e4c4fc791856ba98d8e1b17b5_amd64 as a component of Red Hat Web Terminal 1.14; registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:80ce3ba97b270f58ed0f51a5daa28960a4b4783677f184b0e7815b871a4de46e_amd64 as a component of Red Hat Web Terminal 1.14.

RHSA-2026:70392HighCVSS 7.5

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.1 release.

Vendor

Red Hat Product Security

Published

September 22, 2026

Last Modified

October 5, 2026

🔗 CVE IDs covered (5)

CVE-2026-33818 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-56860 →CVE-2026-56862 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

🎯 Affected products5

Red Hat Web Terminal 1.14
registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:f29ddb20d3f133feacedfff8161478c88b69877441b73e07cd39dd8af39f4cde_amd64 as a component of Red Hat Web Terminal 1.14
registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:48330e9174b84c9d4c10b6f3d23dcfd593372eddd9d922331c0d2dbb9487a99c_amd64 as a component of Red Hat Web Terminal 1.14
registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:df4e707763fbb1d25ce5321422c11a642006e25e4c4fc791856ba98d8e1b17b5_amd64 as a component of Red Hat Web Terminal 1.14
registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:80ce3ba97b270f58ed0f51a5daa28960a4b4783677f184b0e7815b871a4de46e_amd64 as a component of Red Hat Web Terminal 1.14

✅ Remediation

To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.19 or higher. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 CVE IDs covered (5)

📋 Description

🎯 Affected products5

✅ Remediation

🔗 References (13)