RHSA-2026:95081HighCVSS 8.2

Red Hat Security Advisory: Cluster Observability Operator - 1.5

Published
November 4, 2026
Last Modified
November 4, 2026

🔗 CVE IDs covered (33)

CVE-2026-82417 →CVE-2026-84375 →CVE-2026-102278 →CVE-2026-42504 →CVE-2026-85152 →CVE-2026-109829 →CVE-2026-102276 →CVE-2026-27145 →CVE-2026-39834 →CVE-2026-56859 →CVE-2026-75975 →CVE-2026-84445 →CVE-2026-33818 →CVE-2026-39821 →CVE-2026-39822 →CVE-2026-56858 →CVE-2026-56860 →CVE-2026-77301 →CVE-2026-84961 →CVE-2026-109869 →CVE-2026-84292 →CVE-2026-109855 →CVE-2026-63209 →CVE-2026-19534 →CVE-2026-75899 →CVE-2026-84304 →CVE-2026-56862 →CVE-2026-75838 →CVE-2026-75931 →CVE-2026-87018 →CVE-2026-56853 →CVE-2026-109383 →CVE-2026-76172 →

📋 Description

CVE-2026-19534 — undici: undici: Denial of Service via unrequested WebSocket subprotocol CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-75838 — dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization CVE-2026-75899 — fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75931 — fast-uri: fast-uri: Host confusion via skipped IDN canonicalization CVE-2026-75975 — fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization CVE-2026-76172 — fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects CVE-2026-77301 — adm-zip: adm-zip: Denial of Service via uncontrolled memory allocation CVE-2026-82417 — qs: qs: Denial of Service via improper validation in stringify function CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84961 — undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options CVE-2026-85152 — undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-87018 — undici: undici: Denial of Service via TLS renegotiation with mismatched certificate CVE-2026-102276 — brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns CVE-2026-109383 — undici: undici: Certificate validation bypass via dropped TLS options in Agent CVE-2026-109829 — undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching CVE-2026-109855 — undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake CVE-2026-109869 — undici: undici: Denial of Service via unhandled stream error on excessive content encodings

🎯 Affected products98

  • Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:71bb4ed581f561262b23378f567e6b6c783c4d06c6958e42b906ca483ca78c93_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:9ac39e9d927feeccad720d8df32e8ad846a71901f6a252f6fc2458a0ed17c968_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:b809d399db0cc42ca196365b4378e980d79f76d5957b6ba5d5c5660a71e49eb6_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:eb2d75c47058bbfcde2954ac6da8c1972c5de064cb3d7cc2673ad416d932d6fe_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:128cdae616cbd3b5c2c968b22485d7be0f051a4d7a2607c119d503849270db5e_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:6372300ace8311564286b4b827dfb15def13071e86383809463cd60275102139_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:8efbf2da142d24a1d4613a77f1dfe71b0be2c8c49aedef4d30a00ca62b32aa2a_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:b0170f5f2a06fbf06e6c9b8a3aa6c9cb688c1934c1c6f8c3205e2b726024d9d9_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:73b359fbdf2c41877502c8eb795aeae868a9093b4358ab3ee6aa90e15e7873b2_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:443fa9ebb6ac2ca2c840842d6679479fc5955464908e261d44177569eff9c8af_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:49be19a20112c2ca843ea67c984fd880ab18911ef3b8757ea05961fb7379b3c3_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7c939c36153a034eb48b6d6269905bba69ba3991c50e2904f7e943ee5ad6ba57_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:86c1cd15321eaee9004490e5abbc4c3b766518d488e924981f61bcb70c135876_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:70453cda0ffc3424177410281d43b0671eeb5bfde6e4294e2ec28d71653f68b7_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:76486b5692ce55d8b00f61d28cf60e6917a8dc878d8cf6788f170184ffd21839_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:98db286472d5466d241779d0082b57315ff752827761b287993393fa89e369c1_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:a48bd2e1b73405629fe476f83dbb9c707099b42a9d1ef824941ced101a42ff50_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:2cd4f2e7687f9631565357bd5b875f70ed856e4b335c201505e6dc57c679af6d_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:62d939562320165babf6b42bb07b1d69d71a5ada621f4beda36a7cdbf41ca452_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a3e274a01780864f4fa58cc8e3340cc36168968c980b358d2d718d82818b7705_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:e0a36f410898d1ee979dffae62709839d5df6da9643b9cf6074ab3406078fc5c_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:58cf1dac74338e0db4751c90707f4b1c3d93cd6b2d2cb02695e17c4e84f5f5fa_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:65083d63d2413e2d9ff635f7e5a8062ea668fd4c8155d32c787d6f01b473be0a_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:77eed66a0b274ab229ae986813879d1c2f203cbb16623910160d359b05893ec3_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:90c42f2bdbcd27ea4fa0c4dbd55af121b67a0ea7540ebaad30a6ca20a6c3b498_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:20639404ef198fb65a9cad2ccdf07a0ef7383b031ec302472852ceca732f0689_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:acc3365766546d7ee81ca555c78cb2f46856d868efb0a3e7d60511ee5feb2f0f_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:b4350e929666ac7580d6672b4962062b836b82126566d40376da39da3a6c557c_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:bf37ef2edbda7e52c8a54773039bc2058429b61ec95ca6d21a9c39e706db6ca7_arm64 as a component of Cluster Observability Operator 1.5
  • +68 more not shown

✅ Remediation

For Cluster Observability Operator 1.5, see the following instructions to apply this update: https://docs.redhat.com/en/documentation/red_hat_openshift_cluster_observability_operator/1-latest Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package. Workaround: To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Until updates are available, restrict the processing of user-supplied URIs to trusted sources only, implement strict allowlists for destination hosts (preferably IP-based rather than hostname-based), and apply egress filtering to prevent server-initiated connections to internal networks or cloud metadata services. Workaround: There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. Workaround: If an immediate upgrade to qs 6.16.0 is not feasible, avoid re-serializing attacker-influenced parsed query or body objects with qs.stringify. Where qs.parse is used directly, set allowPrototypes: false unless prototype keys are required. For Express applications, review whether the default query parser configuration is necessary. Wrapping qs.stringify calls in try/catch can limit impact to individual requests. Workaround: Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line). Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible to undici 8.10.2 or later.

🔗 References (36)