RHSA-2026:95263MediumCVSS 6.5

Red Hat Security Advisory: RHTAS 1.5.1 - Release of Model Transparency Go 1.0.1

Published
November 4, 2026
Last Modified
November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-39834 →

📋 Description

CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write

🎯 Affected products5

  • Red Hat Trusted Artifact Signer 1.5
  • registry.redhat.io/rhtas/model-transparency-cli-rhel9@sha256:128c46767556694cd8e13fb7f855a26caec64439cfe1684f73a85a48bad4a595_amd64 as a component of Red Hat Trusted Artifact Signer 1.5
  • registry.redhat.io/rhtas/model-transparency-cli-rhel9@sha256:6c8f7b09b649a89a656777e57d5a7ffde23915dffa26c54764a4cbd1b0c2dbcd_ppc64le as a component of Red Hat Trusted Artifact Signer 1.5
  • registry.redhat.io/rhtas/model-transparency-cli-rhel9@sha256:da826875042309c0510aebfd4e64e70069c2600e226172623e6726d5de846434_arm64 as a component of Red Hat Trusted Artifact Signer 1.5
  • registry.redhat.io/rhtas/model-transparency-cli-rhel9@sha256:dc51182be21257e098de5dacbd158d22b05af0d90dc8f20548e953b30a7e5a74_s390x as a component of Red Hat Trusted Artifact Signer 1.5

✅ Remediation

The Model Transparency Go CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor). For details on using the Model Transparency Go CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index

🔗 References (6)