GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

RHSA-2026:55899

Vulnerability from csaf_redhat - Published: 2026-08-18 00:12 - Updated: 2026-09-03 09:01
Summary
Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.1 release.
Severity
Important
Notes
Topic: Red Hat Web Terminal Operator 1.16.1 has been released.
Details: The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-27145

A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64 —
Workaround
Unresolved product id: Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64 —
Workaround
Unresolved product id: Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64 —
Workaround
Threats
Impact Important
CVE-2026-39836

A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service (DoS) for applications using these functions.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64 —
Workaround
Unresolved product id: Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64 —
Workaround
Unresolved product id: Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64 —
Workaround
Threats
Impact Moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Web Terminal Operator 1.16.1 has been released.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:55899",
        "url": "https://access.redhat.com/errata/RHSA-2026:55899"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39836",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39836"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-438",
        "url": "https://redhat.atlassian.net/browse/WTO-438"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-447",
        "url": "https://redhat.atlassian.net/browse/WTO-447"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55899.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.1 release.",
    "tracking": {
      "current_release_date": "2026-09-03T09:01:09+00:00",
      "generator": {
        "date": "2026-09-03T09:01:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:55899",
      "initial_release_date": "2026-08-18T00:12:03+00:00",
      "revision_history": [
        {
          "date": "2026-08-18T00:12:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-03T09:01:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Web Terminal 1.16",
                "product": {
                  "name": "Red Hat Web Terminal 1.16",
                  "product_id": "Red Hat Web Terminal 1.16",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:webterminal:1.16::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Web Terminal"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-exec-rhel9@sha256%3A7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-exec-rhel9\u0026tag=1786654871"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-rhel9-operator@sha256%3A0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-rhel9-operator\u0026tag=1786654612"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-operator-bundle@sha256%3A87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-operator-bundle\u0026tag=1786654751"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-tooling-rhel9@sha256%3A3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-tooling-rhel9\u0026tag=1786654923"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64 as a component of Red Hat Web Terminal 1.16",
          "product_id": "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64 as a component of Red Hat Web Terminal 1.16",
          "product_id": "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64 as a component of Red Hat Web Terminal 1.16",
          "product_id": "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64 as a component of Red Hat Web Terminal 1.16",
          "product_id": "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.16"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27145",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-02T23:01:08.992540+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
          "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
          "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/783621",
          "url": "https://go.dev/cl/783621"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79694",
          "url": "https://go.dev/issue/79694"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5037",
          "url": "https://pkg.go.dev/vuln/GO-2026-5037"
        }
      ],
      "release_date": "2026-06-02T22:01:36.954000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T00:12:03+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.21 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55899"
        },
        {
          "category": "workaround",
          "details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "product_ids": [
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "cve": "CVE-2026-39836",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-05-07T20:01:49.423498+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service (DoS) for applications using these functions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This denial of service flaw exists within the Go `net` package, specifically impacting applications when executed on Microsoft Windows operating systems. Red Hat Product Security has rated this flaw as a Moderate as Red Hat products primarily deploy Go applications on Linux-based environments. Customers operating Go applications, including those bundled with Red Hat products, within a Windows environment should assess their exposure to this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
          "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
          "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39836"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39836",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39836"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39836",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39836"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/775320",
          "url": "https://go.dev/cl/775320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79006",
          "url": "https://go.dev/issue/79006"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4971",
          "url": "https://pkg.go.dev/vuln/GO-2026-4971"
        }
      ],
      "release_date": "2026-05-07T19:41:18.300000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T00:12:03+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.21 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55899"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:7ffa72ca4032f0435dd79b3bcc72f5bed957506558244340c23daee76543d272_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:87a742f7146eea015d6f078c3da94453043e5dc71ebe649618f600fe57ddf68d_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0880560f5d2aa6a707d55d3b2c27f0eaee1dcf985e9fda7fc51be92ed79364ef_amd64",
            "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:3332a2966bcdda130d6938366e51b685294604842bcd973cf46e8e7770509124_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.