RHSA-2026:82315HighCVSS 9.1

Red Hat Security Advisory: Migration Toolkit for Applications

Published
October 13, 2026
Last Modified
October 14, 2026

🔗 CVE IDs covered (12)

CVE-2026-56852 →CVE-2026-56853 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-56862 →CVE-2026-77354 →CVE-2026-33818 →CVE-2026-41178 →CVE-2026-56860 →CVE-2026-73501 →CVE-2026-73502 →CVE-2026-76905 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-73501 — github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default CVE-2026-73502 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unauthenticated nil-pointer dereference CVE-2026-76905 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via malformed multipart/form-data body CVE-2026-77354 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding

🎯 Affected products28

  • Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:0429aea51eeb7ffd6367a88cea433710249a2f62ad51a566b363dbb032ed119d_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:2221fdeae6c54896ebae60984f914b8ad6a7900c99308b2fded8ed424c1de855_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-cli-rhel9@sha256:5c3201937cedd6d9581b51dc5e2c4afbbb4dc0ac18989f661fb8468935e88f7b_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-cli-rhel9@sha256:9163ed14379a7a06d309a9333ad36459312ce0efb4bfde11cde4e51977b4ddd9_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:15bb6993f3830cb001fe4671432ed8ce7609f23f83083189c06658fc3eb28f73_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:36e32b3d4958a474f85fb657394672c54fd8acb4f52dd29cd4f24730adace677_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:03323c7a4c2ce6a6eba28632cd19183de5e12b3883d791a88269a0e8b1eb5801_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:968a0ea4f8dcd6fdfb2c13502046ec10946241b7d3a49188e1c207f5db71af96_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:78009fe42a94b562a856296d23c0f7f2c7fa9ce70f867b16687de3909a2537da_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:c049384124f893bc66f0e525b65c62a56c3436b8878644bc5928873c0106aebe_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-hub-rhel9@sha256:1dc7fbf6a8ee7d1c807f25fb3a26812a24a3bbac0efad68c797fd9070f9b6d3f_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-hub-rhel9@sha256:33de12a53b8f8ab35b2db56f5aeb2edee0b9a0738fb33f8aab2e7cffdc281c36_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:bc9d6063d9d042a1f9b2a11c71a773075a216933f5cf5af3e538614c8ff31d1b_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:beb1c01c5869fb1f9de3463980d3ee3aafe2cc50d1f0053e45e1b9adb6c843ba_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12e5096d8fa16c377611d87044c2c132843b82baa14d94f316a8bada9f9a2c82_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:657915791d6c3e0ce8feda6007cce676a003154ebc1e7cc19b810f90e88b523b_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-operator-bundle@sha256:53accce8f784339f74b2ede47e56a9e8744be3f25f8c87c9a8aa8d817caa0e3e_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:1fad9ff6e53a5d8929431a2929b79a268c8d040a11ea71783fe2d6e4bedcb95f_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:6e46d1165993320b994b94a71a89279cab160f5b222b8a74e0d815028abbdd1b_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:2753c02ffa2f5a03c183fb3f4818a2374f8365e1bcaed52f5aa4dbb26c040646_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:903dc961ededd0d53ed3173e083216ad362f545dd9fbc448ee77e9b2a211572f_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-rhel9-operator@sha256:0c686cd1556801582b2093553d20cc5484519605a327401bfd710902a3d76be0_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-rhel9-operator@sha256:f1e3927868af9d970c5f74aa788855d8c2498c07a46d26cab7b36100f3ab099b_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-solution-server-rhel9@sha256:ee4dbe222bd778ef272ddf3e59dac0844289cc719cd87dea1e24df74f344e097_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-solution-server-rhel9@sha256:fea4e17c615d460eaf8d4d55dc85d55a3adfe40465bb977adfd29d9f381982af_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-ui-rhel9@sha256:7ce47660456e5a3ab4d0880c2b07e21ac0ddced59e62f1e4e483506b3aa6e888_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-ui-rhel9@sha256:f889c64dd327ef718643ad2023d267a9db05e5dd1b05b66ccdc7af16909227ee_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: As a partial workaround, administrators can audit their OpenAPI specification files and ensure every content parameter declares an explicit schema for each media type, which prevents the nil-dereference code path from being reached.

🔗 References (17)