RHSA-2026:8151HighCVSS 9.1

Red Hat Security Advisory: Submariner v0.22 security fixes and container updates

Published
April 14, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (11)

CVE-2026-26018 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-21441 →CVE-2026-26017 →CVE-2026-27137 →CVE-2026-33186 →CVE-2025-61726 →CVE-2025-61728 →CVE-2025-68151 →CVE-2026-25679 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68151 — github.com/coredns/coredns/core/dnsserver: CoreDNS DoS via unbounded connections and oversized messages CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-26017 — github.com/coredns/coredns: CoreDNS: DNS access control bypass due to plugin execution order flaw CVE-2026-26018 — github.com/coredns/coredns: CoreDNS: Denial of Service vulnerability due to predictable pseudo-random number generation CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products34

  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/lighthouse-agent-rhel9@sha256:3a7d7ad6a28416cd4479b5cf1508067e10ce342f01c7bb4aa3676abbd9f43a4a_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/lighthouse-agent-rhel9@sha256:b54f4ec7c1e1f45077ad840b6ddbe3388b640f3acc8b29f68ff59547805ee64d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/lighthouse-agent-rhel9@sha256:c9770153fe0b62c88b947de715ba5867af88c51ad65ec63d319be5a77dcc5c32_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/lighthouse-agent-rhel9@sha256:d3d6fc310945928456e59f5fc04d149af2729d13c27f7c980876d8709e2ce864_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/lighthouse-coredns-rhel9@sha256:251df7bb1820fed1c75e7b5dd14ed2d12a9bf2f3b74c87f6a0027ebf0641d4e5_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/lighthouse-coredns-rhel9@sha256:7ee76ee6dd4a832fccaca245b0f71def3736d90e37476281c273d081234747a2_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/lighthouse-coredns-rhel9@sha256:8b17116d4d52c8ab22a72d9c3ff5e2b0820cc0be99ccc405c4d69a3f7ef933bf_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/lighthouse-coredns-rhel9@sha256:db1083469ea0c8bf20c10252f4e5f500dd38daca85a996e834f866f9618c3e95_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/nettest-rhel9@sha256:00b683c6d8a62a7057f64700526ef5f9eb10dec3809ee1c6d6abda6f76dd79fd_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/nettest-rhel9@sha256:3780b6e2fa5c3c0328a161d6328ed828879c5bdb38cc2ab451366b60ffa5b043_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/nettest-rhel9@sha256:6c394c6c6de11664040b84bbdbe2ae8222bece13e36460774ab3c41fc92f932e_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/nettest-rhel9@sha256:a34e02a2aa68bdad0e1d2aba40bfc782b1b5b9d2b0bc7c9fd391af7417a454a0_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/subctl-rhel9@sha256:613ec029444a86d5510c67551d9b346379413f79064b4a406f8e4ad10b71f5a0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/subctl-rhel9@sha256:6ceaac04b5db279336bdefa462ae02a84e631151315cb6fc657709b72671babf_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/subctl-rhel9@sha256:9f29e3a800b04a0d188957d8f9ca35c85c39107c29fdf97b5b9ba15bbec4cc29_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/subctl-rhel9@sha256:d061e9013521b8b7fe281176926e8b4684fddded2bf166906d8fa5d15ac9da32_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-gateway-rhel9@sha256:1294c67c44cd5ecde081e35432874b6cabdcd17252f9dfc773eb5158213550e7_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-gateway-rhel9@sha256:1823cb53424d92094ff3b1a151501771c5886b25bba4bab79197ad6fd32304ef_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-gateway-rhel9@sha256:c153b1c35cf9aa01c416e7d3dd90b89363715544544c09802039a7629f721c42_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-gateway-rhel9@sha256:d85a0d45300376bd1ba2b272d13c65fa957bf0f78a9ae50dff27eb0d5ce95735_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-globalnet-rhel9@sha256:5f8f4618887f2176dc24bbf6419112f85a68e58d49ff47cb1bbd198f2e148d9d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-globalnet-rhel9@sha256:93a516a33793b18899586982bbf5b3d741cd8fc6d3285972cc014f823ca75a0d_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-globalnet-rhel9@sha256:e3090d6f0a2ca71edf606ca49cafa063ac9ff3122f0d377ed9f25a37151d6fb0_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-globalnet-rhel9@sha256:eedb220436102065b61787715d917459d01e4494a15dffb90474882e8f3086b9_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-operator-bundle@sha256:39088cefc6419019cd9d83bf2f717634fcd01d9befd37b8342553956fae5dd5f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-rhel9-operator@sha256:0d5f60990dd0863cb501bff5f7b94b979bea3f4ef05e07eb825228dfb3de3248_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-rhel9-operator@sha256:3a481555d5376183a2ee392c409739417d5778e2c0559472f9070ccfe2918e2c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-rhel9-operator@sha256:4185f61ee8a0deb08e41e1c51753cdb6c6068c421c8e3dda7f1a86f67ab4fed3_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • registry.redhat.io/rhacm2/submariner-rhel9-operator@sha256:5b5f6ffba68d27f81bb5c26e4fb83d80a4b72523110e622d764f9337d1cb4826_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15
  • +4 more not shown

✅ Remediation

For release note details, see the upstream Submariner release notes: https://submariner.io/community/releases/ Downstream-specific issues resolved: * ACM-28330 * ACM-28332 * ACM-28334 * ACM-28336 * ACM-28338 * ACM-28340 * ACM-28343 * ACM-29328 * ACM-29512 * ACM-29661 * ACM-29662 * ACM-29681 * ACM-29682 * ACM-29683 * ACM-29684 * ACM-29777 * ACM-29801 * ACM-30135 * ACM-30730 * ACM-30731 * ACM-31135 * ACM-31137 * ACM-31861 * ACM-31872 * ACM-31874 * ACM-23783 * ACM-24731 * ACM-24797 * ACM-25518 * ACM-26321 * ACM-26965 * ACM-27273 * ACM-28917 * ACM-30321 * ACM-30640 * ACM-30970 * ACM-8640 For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/ Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (14)