RHSA-2026:91613HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

Published
October 28, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (3)

CVE-2026-27145 →CVE-2026-42504 →CVE-2026-42507 →

📋 Description

CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42507 — net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

🎯 Affected products71

  • OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:21318a4f12fd97da38041a14436d79da39f351749f30792493b6d85b047c6c13_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:9105d4b2ff4d4aaed6fe5ba5f1f144fad91fcc6e102e502a9d17b914bb4753f7_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93406c97607d6789ed69ee0cd3cadcca715bb9409edca4cf2d2205b2e46aac27_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:9af9070e2717632b387d2a7d403c94038053cc82ec6dbb057cfd1ce2eb71e377_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:1ed1bd22978a4b26111d3699df4c9a559219a860ee3fcf5761f27513554bb924_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:1ff5f2b315c6dfe88199e1ea957cb793a36a572a12874810c06c72da2e3f7800_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:ba784d04bf9984aa134494d163fcd6927274f90381b933f11f810c6b580964d2_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:f98ba60d2965a73e41cd305fa59f93b8fc68151e113d2fe31e867d76c67007df_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:06abc08e1806d0c197174a5c7afa2fe349966b9edc263a8dfb74e3dbfa44ac06_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2b17f8c152600cb3749afa970a338773bde8474eba0d95708798a16b19e49082_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:b3c1d0c9639710388607d78e9648b8e9a48e8ae06d9be47adbbeab3d7ccc4876_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:ca0a95d3cf9f803a3d288565f5d8a146daf195f4996c1a5024280bf46064ecd6_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:26f2520b500f46bba7d93d0b905ad3506c7414dd6746fd23929d28057aa6fbe8_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:9e567cf815a509cc9a2230bd49fc81e7d518ee3021f432648b5286b2b8b83e4e_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:a9b240f64f9a535994ec1ca46f2253c4bceb6c185676587cdb60a51e5fb42451_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:dfc4e41ed148db7ca51ed5a587cabd74c193d658f132cb950a4249dad29a51de_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:0fd1e01c4604790a484aed99f25e0a6b40e0a0b06b586cf3fe3fa1ab93d97493_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:154df7018920151ca17cdf4a50fcfdf569e27be8e7cae5a0af77a5b12c620d3d_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:579ccbd6a410482dc0285e82a2bedc6031f84d6b482f4da42fc326dee3c59f61_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b440e7dab2614321f4883d35b834c9b972ae1e8fd60d0d9b6122154d901b0c61_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:50446668505dbbfad17243c77439dd797cba41058f85999435992a265850fb61_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:54a1ac07ae28a22525da78c46e54d8959449102f9f850f0fc8e5fcbdfacbe12d_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:719e8f0a300f5be602b5302d25a3c5c77c8d62ed90b494945e40eee11d5b7973_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ea70a1c3356edc878cc6fdfac03641ca2d1390efe30a6230bd52cc1accdde380_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:2c0e0850d1d7f77e63ebd59a79715bcaaed2f7e424be8dd23c30940a73652e08_amd64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:3574ba8415994fd3e115e79e64f0b474283c41d6b03693035ddc3a5b0534c664_ppc64le as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:99e72c5b8b0b78d9a3102515104df6b458ed5307efc75aab9b3289a7850e92cd_s390x as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ac8444a1114189c1a726906f1da86fce0ecbc7f2824491535b943356f9d3ec22_arm64 as a component of OpenShift API for Data Protection 1.6
  • registry.redhat.io/oadp/oadp-operator-bundle@sha256:c14766550d22cdeab1b564047239e7e4dd40ac1f4da86e20320d2656cb0cc520_amd64 as a component of OpenShift API for Data Protection 1.6
  • +41 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (7)