RHSA-2026:89041HighCVSS 8.5

Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2

Published
October 24, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (17)

CVE-2026-33818 →CVE-2026-56851 →CVE-2026-78667 →CVE-2026-39821 →CVE-2026-46600 →CVE-2026-56862 →CVE-2026-78669 →CVE-2026-111943 →CVE-2026-56858 →CVE-2026-56860 →CVE-2026-84304 →CVE-2026-84445 →CVE-2026-40161 →CVE-2026-40938 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-97031 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-40161 — github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure of Git API token via user-controlled serverURL CVE-2026-40938 — github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands CVE-2026-46600 — golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing CVE-2026-56851 — golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-78667 — net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-97031 — crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products38

  • Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10@sha256:11595df2854c583037aff11fd43bd5900731fd6aa0cd16288d7ee69960f09dc8_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10@sha256:664406223fda9e03aadab2113439cfd50380cc7bc42153057274146497445675_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10@sha256:7ee345785101f6714e2026f10dde07c516c6f1ec8cd4779fe808db8b2490ea9b_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10@sha256:b1a629c643fd4bd2b08ef3fd2a9455164ea7333a2ffce5e90d4ff9852a14e136_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10@sha256:137e489111f5f667706e3aff6ae009b76413941885e57dfac7a7745f07f48d0d_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10@sha256:84540b45322762a2510d898b42e02ccd66f47b9a5b655b4a5da8fe9004c6c59b_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10@sha256:ca6fb8f4c0e4484e36be5b41aca2131d4d7ac4ffaf1d4d82c99656c83fe7a35e_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10@sha256:f70fda57679df64bd440d37c1adfaf171d79cf1a4f1819e9abac0eb29e65a1f9_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10@sha256:4d872f99022f47a0db5ad1137921c7b34c72f285d2b9c645840322d49a3c90a3_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10@sha256:573bdfe5014404ecff08105c5ffb58e91e0a788a04966eb970f4847710a54864_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10@sha256:cfa90c56d2573803576e0b6678e03bb9a6cfee8a582bbbe158c35bd3e562961e_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10@sha256:f803eb0c6cee0f2773e69985ccbe15272f74438a860d71d0b18887308f9566cd_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10@sha256:141f9e7db0369f613bc539aa483c24719feb8b5481fbc6dfe881736afc43dcaa_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10@sha256:497295e69e436831b2014d8929d5ecf4711cae95f27048710732285963ca75df_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10@sha256:86da529c8ed04f6870bd0ad3d49f665f6e0c8a865a5adaf002622c8e726651c7_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10@sha256:da3584c6fb7821d929c556f037e559974ac89487b1575be5d45627f5fc29a205_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-operator-bundle@sha256:373dc38d83d560b3a3b35f0fa4865826bcd19bebe735e48aec5141b826ab2b7b_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-rhel10-operator@sha256:042fbf2da45fff01deae9a6032515f3d97f158ee6d0b0537aed30931c0631d07_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-rhel10-operator@sha256:78bfd3e4ff55b973f808004c33b22258967b6d1434ea1dd86f3acd9d423ccbcd_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-rhel10-operator@sha256:c4d36d430d9fbfb19bcc9c10c55ee477d9308d5f57dc81eab8762a127d35d80e_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-rhel10-operator@sha256:f7a274fba60644bc3ca2de506140a6dca598b12a64b9463542cb6e118d2f2f30_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10@sha256:356261cd64e02387bdc88ee6f3b415b4c74f8a29e3e2fa4466ce12773b5c4240_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10@sha256:91d61aa8fbc4f3a0dde99430110c135873c60fa9fae84da28d15f0611396151b_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10@sha256:b3938cb6923482786daa1a39394f468ba635a8ede7132860055bf2775e49985f_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10@sha256:ef2aaa078f2b49f54998ce06ee3cc2fc0b8dbc8d498b6dd2a0f48723aaf50a2f_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel10@sha256:119c1854387e584849f48dd4d9f67be23e3d1940cf44f22c0efe66628253a86e_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel10@sha256:2032f6d8c358812ff60eafa9032de35f5a5b6070f090eaead666561ed8beb22a_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel10@sha256:b6e2a3e37df8b466bf1e22948e1bc17bbc62257384aac71cf01eaf480a444341_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel10@sha256:bb5d865c64a8d71b11f08b1d658f01b554732121be010b8682ef81c4d39638bd_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • +8 more not shown

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: To mitigate this issue, ensure that the Git API token parameter is always explicitly provided when configuring Tekton Pipelines. Additionally, restrict permissions for creating TaskRun or PipelineRun resources to only trusted users to limit the attack surface. Review and enforce policies that prevent the use of user-controlled serverURLs without proper token authentication. Configuration changes may require a restart or reload of affected services to take effect. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (20)