RHSA-2026:89131CriticalCVSS 8.5

Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2

Published
October 24, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (18)

CVE-2026-33818 →CVE-2026-39821 →CVE-2026-40938 →CVE-2026-56853 →CVE-2026-56858 →CVE-2026-78667 →CVE-2026-114406 →CVE-2026-40161 →CVE-2026-56851 →CVE-2026-56862 →CVE-2026-46600 →CVE-2026-56860 →CVE-2026-78669 →CVE-2026-84445 →CVE-2026-56859 →CVE-2026-84304 →CVE-2026-97031 →CVE-2026-111943 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-40161 — github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure of Git API token via user-controlled serverURL CVE-2026-40938 — github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands CVE-2026-46600 — golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing CVE-2026-56851 — golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-78667 — net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-97031 — crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns

🎯 Affected products38

  • Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10@sha256:1f8f7e8416de4f14810c18ede8f96486457062a9323d465a439cbf27ffaadd57_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10@sha256:41e99f5dea364f0de41184e7347775788ff5b55e69a51ec223ca0089adbe3d97_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10@sha256:4b0ab2041aa128c74e860ffc2709fcab8fed6389c22fc09b1bc4b2c5aad9392a_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10@sha256:f0c1290d70b77a3b7bc83b183abb870438b564bcb4f0597a215d2487d691f4c9_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10@sha256:4019ff7c4c20d745c970c829c1ea0b0cbaab3271e9aeecf8e6a6975eae0250c5_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10@sha256:5f0e83fa072d2c0b377316d39c040e85589617d2f09045d7ba6143f3b8487236_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10@sha256:749afbd994db8b75a0e3bb50982a597b2da94e2dc10c2014715ccb49ddf7154c_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10@sha256:dcd025175a5c13628954c9840f7b9617903e788000426cde8f7d5119854a3d56_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10@sha256:07017952e47c4580e376a8aa00d7b4f40e4809c444b1c4d11e526929319d1e54_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10@sha256:0b7b0906619eabc1ac3a161e5762ec11684086ec9a7915bda1a8dfc6863ad9f9_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10@sha256:bb0b42eb07ef9c8e1a1e45d6cd2821718be104dae1ef839d5d5f526fc881d87e_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10@sha256:f57e7ab46c730ce39e89b650ada238c99f8ca565baca762d500ff90e3f93ea29_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10@sha256:3c6347cb8f716d7f5a8817fd42f5c1b226f26c2d7198790886d03585dcf57979_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10@sha256:5b80425db95d99298fb5fdea03e3ef79efd4d9d925ef8a644cc5f8a7abe48843_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10@sha256:7dd65709022285786b5e325a6e1483f3a2e2b398cb02d8e86028e24d8fda9865_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10@sha256:b1f95359097339473ba91792f031783566dd0da7b4e9967dd4f518cef0599913_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-operator-bundle@sha256:029d766c4d9f339659da8b20644df820cf3e4ee61cc618adf3735138945c77ec_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-rhel10-operator@sha256:35b3ebc5c1228b2da2813b5fb57a2e6ef6daa60ff7fd6c2dddd62cb5f68a5e3e_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-rhel10-operator@sha256:4db4f485f670768f43f68f70bbb27d1b2700b50524a9184a0c82f077ec7a6d4f_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-rhel10-operator@sha256:a1dedecf6558d8555d934cf6490153a01927ef40341254efb6c1e9a9b7f50e95_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-rhel10-operator@sha256:a9ab23e52fe82ee888461eb632e3003696603f2ae2d9c106eb5c61e3d8e8225b_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10@sha256:96ac86cc8c505eb755d510b1f433b9c687877dfa8086585fa97ea72f31d3202f_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10@sha256:ae6c47a18e3430e92bd256c64e6df4ad580d6460b7639298d8ef12238d565552_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10@sha256:c850f527fec1a7216018e8fdabe6b9d9e9964d61a713f15c828dd8d1f89a3d7a_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10@sha256:fc27c2ae87fbc55217886fc61ec74b8ea9ca7e9623d7889229391e371e7dcaa4_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel10@sha256:c5fc8308e35852849007fbc46a8edd0d29cea8186f4005c07f8d4b9bded0a768_amd64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel10@sha256:ce44ab3d9710fdd7c57eb0a88f06b0fcf1f5bb002fd845eea9cb5fc9f2f8e809_arm64 as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel10@sha256:e2376bab4746300665bedd93e6f96116d4885cc73ab8aab78adbba64a83a5eb8_s390x as a component of Red Hat OpenShift Builds 1.9.2
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel10@sha256:fde178513f2675c124141e159e07544cd808cd3b7df597c9bad45630c54e553d_ppc64le as a component of Red Hat OpenShift Builds 1.9.2
  • +8 more not shown

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: To mitigate this issue, ensure that the Git API token parameter is always explicitly provided when configuring Tekton Pipelines. Additionally, restrict permissions for creating TaskRun or PipelineRun resources to only trusted users to limit the attack surface. Review and enforce policies that prevent the use of user-controlled serverURLs without proper token authentication. Configuration changes may require a restart or reload of affected services to take effect. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (21)