Vulnerability-Lookup

RHSA-2026:92303

Vulnerability from csaf_redhat - Published: 2026-10-29 07:53 - Updated: 2026-11-03 10:13

Summary

Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.12 security update

Severity

Important

Notes

Topic: Red Hat multicluster engine for Kubernetes v2.8 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Details: The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs

Affected products

Fixed 52 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x	—	Vendor Fix fix Workaround

Known not affected 56 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64	—	Workaround

Threats

Impact Important

CVE-2026-39822

A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-59 - Improper Link Resolution Before File Access

Affected products

Fixed 36 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x	—	Vendor Fix fix Workaround

Known not affected 72 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64	—	Workaround

Threats

Impact Important

CVE-2026-39834

A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnerability causes the write loop to spin indefinitely, continuously sending empty packets without making progress. The primary consequence is a denial of service (DoS), as the affected system consumes resources and prevents legitimate data transfer.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Vendor Fix fix

Known not affected 104 products

Product	Identifier	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x		—

Threats

Impact Moderate

CVE-2026-56853

A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 48 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x	—	Vendor Fix fix

Known not affected 60 products

Product	Identifier	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64		—

Threats

Impact Important

CVE-2026-56858

A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation

Affected products

Fixed 56 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x	—	Vendor Fix fix Workaround

Known not affected 52 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64	—	Workaround

Threats

Impact Important

CVE-2026-56859

A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs

Affected products

Fixed 40 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x	—	Vendor Fix fix Workaround

Known not affected 68 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64	—	Workaround

Threats

Impact Important

CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 52 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64	—	Vendor Fix fix
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x	—	Vendor Fix fix

Known not affected 56 products

Product	Identifier	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x		—
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64		—

Threats

Impact Important

CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 40 products, the same list as for CVE-2026-56859

Known not affected 68 products, the same list as for CVE-2026-56859

Threats

Impact Important

CVE-2026-63209

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads to out-of-bounds memory access, crashing the application and resulting in a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-823 - Use of Out-of-range Pointer Offset

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64	—	Vendor Fix fix Workaround

Known not affected 104 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x	—	Workaround

Threats

Impact Important

CVE-2026-84304

A flaw was found in gRPC-Go. This vulnerability allows an unauthenticated remote attacker to exhaust process memory by sending millions of fragmented HTTP/2 DATA frames. Each fragmented frame is stored as a separate message, consuming disproportionate heap memory. This can lead to a runtime panic or out-of-memory termination, resulting in a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64	—	Vendor Fix fix Workaround

Known not affected 104 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x	—	Workaround

Threats

Impact Important

CVE-2026-93748

A flaw was found in http-cache-semantics. This vulnerability allows unauthenticated attackers to retrieve cached responses, including sensitive session credentials like Set-Cookie values, belonging to other users. This occurs because the component fails to properly validate security-zeroed cache entries when processing client `max-stale` directives. By requesting the same URL with a large `max-stale` value, an attacker can obtain another user's session credentials from shared-cache entries that were intended to be secure.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-524 - Use of Cache Containing Sensitive Information

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:1fd13a7fd4ca2f876f1fb7e057916234f2ed932f24833debc3f82fbbb94d137f_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e0401fbdaf97dea852a14397766fb8a8b81e188f8f71a88c215efb77f929932_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:87d97f7e054e6389b929770a07ef2950a2fb7067ddd57feddd61ee99625d58a0_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:c08d09c1bb7cb442b31a77dec76270d4fe06f236eb3e9ac0c51cb6bc5771c7c9_amd64	—	Vendor Fix fix Workaround

Known not affected 104 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:911b20228e5094a072078c950c071aab7fa73a5d56710669b7c0e4d2b42fe4d9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:df11e9fcfea4ee9c74d974e9499fa73e2791c482f48d8d753ee3a2e08e8e7e99_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e95244112b29fc839545177fcfeb1b3a34a47b9aac480bd790aed65518557bf2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:42ce600caf28405e45e953ffcb07ff19eb52e04f068c1553d0e35a3e3f3ff239_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:68bdc26fb272af73360e0973611d077abbefee0b8c937a137433ee99710e6cca_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:8e483ec8682edbfe9777066a22df3b071fb45faaf98246dc8df8bb42737963c2_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b55968a49c69f0f6f5f8aaba7838f3c881674cc22f14a130dad131ae4dd03e49_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:4234bc89061a1474013d6f35f7ae3df00e6f869e5be5413c52b58a011699523f_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:72f7cdf6c3ee0ed01f49de3b06d6f007c0ce9c992f4b2f39d88e810ed52210a7_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c089df9f85e559260c24bbe0865f73254b0db91a722ec0e2635bdbb0a65686ca_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:eb26ec20f809f8ef5b58207160201128a5a832c2a08f361b7756aa72c538626f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:1efadb9d38485590dcc2356c5f7650a33bcd487f6049f9d0af34af781c6c9b46_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ad843f0d29b83e89309874c7d052db1ea67a248052a21268a5fcbcd75e39be50_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:b3c17fa7f841fee454f742bb6e8fbdaaac1296d9eb21ca9173d58a90f5fd6cf0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:ea5ca4710a94babb14f92d596d9d49f5eb8e33f2be270dc79d21ae741054b671_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6fdf3d496f1987dce7f870ae9beb3fd1e46c35e83e313f599f75d499716b0541_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:80b798bfdaccf242381d3abec97d40f9a25c4a18423d30c4ccad7514838f5a35_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ac97a1fc81bebf3b7386ab1364646714a1feffbe6536a3fb223b9c48e4a1a186_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ece692b24e8a7f7c944258d47b9854e6073cf33a9d187da98eeb15ffc7fc2bcb_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:133b4e17c50624e477fcbf82ee5476f32f76f8de896653bfc3f5195991d88c9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:15383fffc045f8b42f9fdfb8c00758a39fb241d9a47c863225baaba15c486186_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:37297750d3cf30206ffd33e391feb7658cc33df202156e398c7f39a454a1564c_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:844d2dc18846250bbb2041b68e249259166d8232ddeaf7e40bc6570906403cbf_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:1059380731a1c61e0767c3ee5b058d01a0afbf2b49d9294b8155a73d2345b07c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:20bd510b6409a8d97ae59c5f0373df41b5073aaf9f7642dc6ec40dbbcf1797f7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:bfd8eabd5491c5d077af17497d4caafc07c1dab9f0b625018f6caec157d8d5c6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:ca7ccbe617e1d05312a0149bf7ec000063e5d0843eff9ccb3e5584134ca030d1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:15381911250e506468896837b9f14f71493295841b141fa798e3839bf20132c2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:2bc01bf9abbff6e5e7669fd90788c23102e4ca4dfe7eda6fb8f6701279b83021_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:6509f647f3f59c7cea447e88e8667c8a538a8d0e052018c248ee43b3ed7d017b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:a6faf850a3694feb83b2bcb7585c8f751fdc19bad48608203870f197550a93ce_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:283d86978486a20b80e818d8da0675c7ea7cbf67e8fa02cf0ffec09780e9c28f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:a5cef7e7006d6d0cc30dd74035ac2e978a63b44c900b00ad121dda25432d6f8b_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:aa08bd5652c5bed867cb99aadb28b9991f57043dafb78eb278138543c97498c4_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e615fb492c720604d7bc5715e3454fb439acc8983a60c80e49f6cf1f37c70344_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:06819a5f5008997e7d58b8121bbc67cce05c9d53c7907f104d99ca89654d6ffa_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:1ddc11d644ad3d327abd2f79469e2e86f522241a7254b0547d071f316f31871f_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:340f3b6c3dd267b920afab5e06808426823a5c0a6dc66e298d96f07ac3fd8f95_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:e378eaba348d4cf8376dc0f5b5d76db8b751464afbea29a21eeb20a97c0d727c_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:38e6db4a331acde2bbe8b6e7ea015a15b0c5c1592634f82c05a682749f572978_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:95712977b06d49dec992ad4bb79d6e0ce4f7952a54ac17e7ffdeefcf1fbfbfe0_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:d80ab64e72cc839e540919b5623e9bceab8ff31e781930a44dfd62e2d7f14b22_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f7cda068d65baf97f9d52b8755e218d7c95aaa56a1d5a579ab82403622080a1c_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:1b23ebbe7290a6b7955711dfcb6718081c2f964311b2ae37c2d4e4680846dde8_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2638d9ef0d331cd8ce004441d9e62535d6e3fc7bbd283455a47c1a3c49382aaf_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:70c278616b29b69502fb62fdcfa114b26f5d3bf2f1382d21a15089b82d024ba1_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:cfe1b251cda6bd13ae23a3e1b15564737cdc99f41edfa6086f2d60efacb7e012_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:198d8f6da7b48d674cbfba78e761e424dabd9a2df12a09025a3d87b2033f7ae7_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:26404effad858690f6c347cbdbecc7cf63d380dfed58a7bdbeaab47107cb32dd_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:829398b46c62cb1fe510ea31b910469e3ea3f2f2619ffef07d528da486624d05_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:f2936073ca577fc326ceddc8025d67184dc3755dea7bf5712a735b06a4142a3c_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3854e0576c7f3257e62afa127c30d5eb9cd035230a4cb61d6a9b6a16ad04bf5e_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:85d788b49ae0d544238f66ec72d0e0752d21839daff8ef81cdeb90baaa3096a2_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:8ae2c52e7b8e22d8ef37014f683689780bb1001b8b95422e49d8c486018f6a9e_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:d913b9f08b4f4c09268f11843f132320219334140d3ed30297a32ab7c8f69c5b_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:0670a55a6a3fe9ba9b62e32b576f4299224db3cc0f9e7c7f4c785625f41b2ae6_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:733f50686ebda7e974ff24b92c735bebc51c1be66113e49d8f7576b8ec04de0d_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:92bd2876ccb114e948c5b5d3dfe9f023efed8730b9ad9a6b44ee0db894226b49_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:f07ee55c81996bd16ea4237144d1bc4d98251aaba74f7caa86aadd4f4e0d1d33_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:1f31cffd7d0230ef257c893d03d2d787f2ad9ccd8511f33bc2037210d9693640_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4b1255fe5911fc77da3f2d9dc646ae5c487e2e1ce4cb96519cea90b41a603094_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:cd128696375c4d5083db701d705bbf7ca02fb3b07578a4974d4ae90b12cb2756_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:f1abdfc7f89d1d230717cd064ada180275dc2c8c0c5a733ce4a706163649c98c_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2eb325ed7dbf9e652aab0e35656a7df4c87c2a592a332fbf9fe3a4f7428979a0_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:4ae50f20f8ac188c243c1a09aef40f98e921adb7c02c5844c0e4c53686af1129_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e3b4c59e6c1fdb8e38e02e5b6674cea4ed07f11e4d42d88cc4fe6424daf8b639_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ea5d5e825a386aa67f842e64d0ea8829590d34264b7d5da4e0a50d6a18e00ebd_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:23aca3cf3304c7cd8820af7eef10d5f9672c665b28e2f9a80252c1d21b9c220b_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5665bd9856e15e1ea25eae02c633858de5b8b5feddaacb8a744a029d5d8ae55f_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:755952c2390699e64f41292ee7146fb84c2ed66c9a68fc4fb1e947bc634f4889_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d4751b481bc5b0f4b57991b1526ff5f8829b2b41387f9ad1767227fde7baeba3_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:7b1266086fdca4386049658f9400ef25d81c302420f7f25621196aa550e849e9_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:89b342001763d136ff9787cebfb0d028d6e3958f28dd6bb41b21cc1cabc9f2ee_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:9af55845fa4312d28ee5d830f67ac51c75eb4a4437e58cca751357ca4f3c366e_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:bdfc1fb67fe473d4ea04069b6b257b6f1027e9fc36b077e070348cec2bc3636a_s390x	—	Workaround

Threats

Impact Important

CVE-2026-106445

A flaw was found in Handlebars. The lookupProperty own-property check returns Function.prototype.constructor before the prototype-method deny list is applied. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, arbitrary JavaScript can execute with the application process privileges.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-184 - Incomplete List of Disallowed Inputs

Affected products

Fixed 4 products, the same list as for CVE-2026-93748

Known not affected 104 products, the same list as for CVE-2026-93748

Threats

Impact Important

CVE-2026-106446

A flaw was found in Handlebars. Incomplete validation of pre-parsed AST objects passed to compile() or precompile() allows unchecked AST fields to be emitted into generated JavaScript. An attacker who can supply an object instead of a template string can inject and execute arbitrary JavaScript in the application process.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code

Affected products

Fixed 4 products, the same list as for CVE-2026-93748

Known not affected 104 products, the same list as for CVE-2026-93748

Threats

Impact Important

References

115 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:92303	self
https://access.redhat.com/security/cve/CVE-2026-106445	external
https://access.redhat.com/security/cve/CVE-2026-106446	external
https://access.redhat.com/security/cve/CVE-2026-33818	external
https://access.redhat.com/security/cve/CVE-2026-39822	external
https://access.redhat.com/security/cve/CVE-2026-39834	external
https://access.redhat.com/security/cve/CVE-2026-56853	external
https://access.redhat.com/security/cve/CVE-2026-56858	external
https://access.redhat.com/security/cve/CVE-2026-56859	external
https://access.redhat.com/security/cve/CVE-2026-56860	external
https://access.redhat.com/security/cve/CVE-2026-56862	external
https://access.redhat.com/security/cve/CVE-2026-63209	external
https://access.redhat.com/security/cve/CVE-2026-84304	external
https://access.redhat.com/security/cve/CVE-2026-93748	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-33818	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://www.cve.org/CVERecord?id=CVE-2026-33818	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818	external
https://go.dev/cl/814980	external
https://go.dev/issue/80405	external
https://groups.google.com/g/golang-announce/c/94p…	external
https://pkg.go.dev/vuln/GO-2026-5972	external
https://access.redhat.com/security/cve/CVE-2026-39822	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498152	external
https://www.cve.org/CVERecord?id=CVE-2026-39822	external
https://nvd.nist.gov/vuln/detail/CVE-2026-39822	external
https://go.dev/cl/797880	external
https://go.dev/issue/79005	external
https://groups.google.com/g/golang-announce/c/Orm…	external
https://pkg.go.dev/vuln/GO-2026-4970	external
https://access.redhat.com/security/cve/CVE-2026-39834	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480676	external
https://www.cve.org/CVERecord?id=CVE-2026-39834	external
https://nvd.nist.gov/vuln/detail/CVE-2026-39834	external
https://go.dev/cl/781663	external
https://go.dev/issue/79567	external
https://groups.google.com/g/golang-announce/c/a08…	external
https://pkg.go.dev/vuln/GO-2026-5020	external
https://access.redhat.com/security/cve/CVE-2026-56853	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515827	external
https://www.cve.org/CVERecord?id=CVE-2026-56853	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56853	external
https://go.dev/cl/795540	external
https://go.dev/issue/80205	external
https://pkg.go.dev/vuln/GO-2026-6089	external
https://access.redhat.com/security/cve/CVE-2026-56858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515838	external
https://www.cve.org/CVERecord?id=CVE-2026-56858	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56858	external
https://go.dev/cl/807100	external
https://go.dev/issue/80435	external
https://pkg.go.dev/vuln/GO-2026-6091	external
https://access.redhat.com/security/cve/CVE-2026-56859	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515840	external
https://www.cve.org/CVERecord?id=CVE-2026-56859	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56859	external
https://go.dev/cl/803320	external
https://go.dev/issue/80481	external
https://pkg.go.dev/vuln/GO-2026-6088	external
https://access.redhat.com/security/cve/CVE-2026-56860	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://www.cve.org/CVERecord?id=CVE-2026-56860	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860	external
https://go.dev/cl/803681	external
https://go.dev/issue/80494	external
https://pkg.go.dev/vuln/GO-2026-6218	external
https://access.redhat.com/security/cve/CVE-2026-56862	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://www.cve.org/CVERecord?id=CVE-2026-56862	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862	external
https://go.dev/cl/804261	external
https://go.dev/issue/80528	external
https://pkg.go.dev/vuln/GO-2026-6090	external
https://access.redhat.com/security/cve/CVE-2026-63209	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543236	external
https://www.cve.org/CVERecord?id=CVE-2026-63209	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63209	external
https://github.com/klauspost/compress/commit/5392…	external
https://github.com/klauspost/compress/releases/ta…	external
https://github.com/klauspost/compress/security/ad…	external
https://access.redhat.com/security/cve/CVE-2026-84304	self
https://bugzilla.redhat.com/show_bug.cgi?id=2526955	external
https://www.cve.org/CVERecord?id=CVE-2026-84304	external
https://nvd.nist.gov/vuln/detail/CVE-2026-84304	external
https://github.com/grpc/grpc-go/commit/7354d9c8de…	external
https://github.com/grpc/grpc-go/commit/8cfeca0e1e…	external
https://github.com/grpc/grpc-go/pull/9331	external
https://github.com/grpc/grpc-go/pull/9333	external
https://github.com/grpc/grpc-go/releases/tag/v1.83.1	external
https://github.com/grpc/grpc-go/security/advisori…	external
https://access.redhat.com/security/cve/CVE-2026-93748	self
https://bugzilla.redhat.com/show_bug.cgi?id=2538111	external
https://www.cve.org/CVERecord?id=CVE-2026-93748	external
https://nvd.nist.gov/vuln/detail/CVE-2026-93748	external
https://github.com/kornelski/http-cache-semantics	external
https://github.com/kornelski/http-cache-semantics…	external
https://github.com/kornelski/http-cache-semantics…	external
https://github.com/kornelski/http-cache-semantics…	external
https://www.vulncheck.com/advisories/http-cache-s…	external
https://access.redhat.com/security/cve/CVE-2026-106445	self
https://bugzilla.redhat.com/show_bug.cgi?id=2547112	external
https://www.cve.org/CVERecord?id=CVE-2026-106445	external
https://nvd.nist.gov/vuln/detail/CVE-2026-106445	external
https://github.com/handlebars-lang/handlebars.js/…	external
https://github.com/handlebars-lang/handlebars.js/…	external
https://github.com/handlebars-lang/handlebars.js/…	external
https://github.com/handlebars-lang/handlebars.js/…	external
https://access.redhat.com/security/cve/CVE-2026-106446	self
https://bugzilla.redhat.com/show_bug.cgi?id=2547120	external
https://www.cve.org/CVERecord?id=CVE-2026-106446	external
https://nvd.nist.gov/vuln/detail/CVE-2026-106446	external
https://github.com/handlebars-lang/handlebars.js/…	external
https://github.com/handlebars-lang/handlebars.js/…	external

JSON

To clipboard

Loading 1.2 MB of JSON…

CVE-2026-106445 (GCVE-0-2026-106445)

Vulnerability from cvelistv5 – Published: 2026-10-06 19:39 – Updated: 2026-10-12 14:33

Title

Handlebars: JavaScript Injection via Own Property Check Bypass

Summary

Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 01:42 UTC

CWE

CWE-184 - Incomplete List of Disallowed Inputs
CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7963 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/handlebars-lang/handlebars.js/…	x_refsource_CONFIRM
https://github.com/handlebars-lang/handlebars.js/…	x_refsource_MISC
https://github.com/handlebars-lang/handlebars.js/…	x_refsource_MISC
https://github.com/handlebars-lang/handlebars.js/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
handlebars-lang	handlebars.js	Affected: >= 3.0.0, < 4.7.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106445",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T01:42:53.531967Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T01:43:16.576Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "handlebars.js",
          "vendor": "handlebars-lang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 4.7.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application\u0027s privileges. This issue is fixed in version 4.7.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1289",
              "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:33:33.060Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f"
        },
        {
          "name": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/handlebars-lang/handlebars.js/pull/2185"
        },
        {
          "name": "https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa"
        },
        {
          "name": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"
        }
      ],
      "source": {
        "advisory": "GHSA-p8wg-vrv2-v86f",
        "discovery": "UNKNOWN"
      },
      "title": "Handlebars: JavaScript Injection via Own Property Check Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106445",
    "datePublished": "2026-10-06T19:39:08.916Z",
    "dateReserved": "2026-10-06T16:49:40.590Z",
    "dateUpdated": "2026-10-12T14:33:33.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106446 (GCVE-0-2026-106446)

Vulnerability from cvelistv5 – Published: 2026-10-06 19:41 – Updated: 2026-10-07 18:30

Title

Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

Summary

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 18:27 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7963 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/handlebars-lang/handlebars.js/…	x_refsource_CONFIRM
https://github.com/handlebars-lang/handlebars.js/…	x_refsource_MISC
https://github.com/handlebars-lang/handlebars.js/…	x_refsource_MISC
https://github.com/handlebars-lang/handlebars.js/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
handlebars-lang	handlebars.js	Affected: >= 4.0.0, < 4.7.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106446",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T18:27:28.577129Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T18:30:12.451Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "handlebars.js",
          "vendor": "handlebars-lang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.7.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T19:41:55.785Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj"
        },
        {
          "name": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/handlebars-lang/handlebars.js/pull/2185"
        },
        {
          "name": "https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2"
        },
        {
          "name": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"
        }
      ],
      "source": {
        "advisory": "GHSA-8r5x-fm3f-whwj",
        "discovery": "UNKNOWN"
      },
      "title": "Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106446",
    "datePublished": "2026-10-06T19:41:55.785Z",
    "dateReserved": "2026-10-06T16:49:40.590Z",
    "dateUpdated": "2026-10-07T18:30:12.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33818 (GCVE-0-2026-33818)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-11-03 11:21

Title

Enforce maximum recursion depth in encoding/asn1

Summary

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:11 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/80405
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/814980
https://pkg.go.dev/vuln/GO-2026-5972

Impacted products

1 product

Vendor	Product	Version
Go standard library	encoding/asn1	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Marwan Atia (marwansamir688@gmail.com)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:11:19.904646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:12:34.877Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/asn1",
          "product": "encoding/asn1",
          "programRoutines": [
            {
              "name": "parseSequenceOf"
            },
            {
              "name": "parseField"
            },
            {
              "name": "UnmarshalWithParams"
            },
            {
              "name": "Unmarshal"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Marwan Atia (marwansamir688@gmail.com)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T11:21:22.772Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80405"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/814980"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "title": "Enforce maximum recursion depth in encoding/asn1"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-33818",
    "datePublished": "2026-08-13T21:58:52.821Z",
    "dateReserved": "2026-03-23T20:35:32.815Z",
    "dateUpdated": "2026-11-03T11:21:22.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-39822 (GCVE-0-2026-39822)

Vulnerability from cvelistv5 – Published: 2026-07-08 15:46 – Updated: 2026-07-08 19:39

Title

Root escape via symlink plus trailing slash in os

Summary

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-08 18:06 UTC

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/79005
https://groups.google.com/g/golang-announce/c/Orm…
https://go.dev/cl/797880
https://pkg.go.dev/vuln/GO-2026-4970

Impacted products

1 product

Vendor	Product	Version
Go standard library	os	Affected: 0 , < 1.25.12 (semver) Affected: 1.26.0-0 , < 1.26.5 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.2 (semver)

Credits

Mundur (https://github.com/M0nd0R)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-39822",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T18:06:16.360721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-61",
                "description": "CWE-61 UNIX Symbolic Link (Symlink) Following",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T19:39:17.341Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "os",
          "product": "os",
          "programRoutines": [
            {
              "name": "rootOpenFileNolog"
            },
            {
              "name": "openRootInRoot"
            },
            {
              "name": "OpenInRoot"
            },
            {
              "name": "Root.Create"
            },
            {
              "name": "Root.Open"
            },
            {
              "name": "Root.OpenFile"
            },
            {
              "name": "Root.OpenRoot"
            },
            {
              "name": "Root.ReadFile"
            },
            {
              "name": "Root.WriteFile"
            },
            {
              "name": "rootFS.Open"
            },
            {
              "name": "rootFS.ReadDir"
            },
            {
              "name": "rootFS.ReadFile"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.5",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.2",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mundur (https://github.com/M0nd0R)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, \u0027root.Open(\"symlink/\")\u0027 will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T15:46:27.199Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79005"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
        },
        {
          "url": "https://go.dev/cl/797880"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4970"
        }
      ],
      "title": "Root escape via symlink plus trailing slash in os"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-39822",
    "datePublished": "2026-07-08T15:46:27.199Z",
    "dateReserved": "2026-04-07T18:13:03.527Z",
    "dateUpdated": "2026-07-08T19:39:17.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-39834 (GCVE-0-2026-39834)

Vulnerability from cvelistv5 – Published: 2026-05-22 02:31 – Updated: 2026-05-22 18:50

Title

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

Summary

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-22 18:50 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/79567
https://groups.google.com/g/golang-announce/c/a08…
https://go.dev/cl/781663
https://pkg.go.dev/vuln/GO-2026-5020

Impacted products

1 product

Vendor	Product	Version
golang.org/x/crypto	golang.org/x/crypto/ssh	Affected: 0 , < 0.52.0 (semver)

Credits

NCC Group Cryptography Services, sponsored by Teleport

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-39834",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-22T18:50:30.848292Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-22T18:50:51.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "channel.WriteExtended"
            },
            {
              "name": "Dial"
            },
            {
              "name": "NewClientConn"
            },
            {
              "name": "NewServerConn"
            },
            {
              "name": "Session.CombinedOutput"
            },
            {
              "name": "Session.Output"
            },
            {
              "name": "Session.Run"
            },
            {
              "name": "Session.Shell"
            },
            {
              "name": "Session.Start"
            },
            {
              "name": "channel.Write"
            },
            {
              "name": "curve25519sha256.Client"
            },
            {
              "name": "curve25519sha256.Server"
            },
            {
              "name": "dhGEXSHA.Client"
            },
            {
              "name": "dhGEXSHA.Server"
            },
            {
              "name": "dhGroup.Client"
            },
            {
              "name": "dhGroup.Server"
            },
            {
              "name": "ecdh.Client"
            },
            {
              "name": "ecdh.Server"
            },
            {
              "name": "extChannel.Write"
            },
            {
              "name": "mlkem768WithCurve25519sha256.Client"
            },
            {
              "name": "mlkem768WithCurve25519sha256.Server"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.52.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "NCC Group Cryptography Services, sponsored by Teleport"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-22T02:31:27.540Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79567"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
        },
        {
          "url": "https://go.dev/cl/781663"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5020"
        }
      ],
      "title": "Invoking  infinite loop on large channel writes in golang.org/x/crypto/ssh"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-39834",
    "datePublished": "2026-05-22T02:31:27.540Z",
    "dateReserved": "2026-04-07T18:13:03.529Z",
    "dateUpdated": "2026-05-22T18:50:51.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56853 (GCVE-0-2026-56853)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:23

Title

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Summary

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:22 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/80205
https://go.dev/cl/795540
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6089

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56853",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:22:45.475320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:23:18.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "conn.readRequest"
            },
            {
              "name": "conn.serve"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.092Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80205"
        },
        {
          "url": "https://go.dev/cl/795540"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "title": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56853",
    "datePublished": "2026-08-13T21:58:53.092Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-14T15:23:18.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56858 (GCVE-0-2026-56858)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:32

Title

Fix Javascript regexp context tracking in html/template

Summary

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:31 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/80435
https://go.dev/cl/807100
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6091

Impacted products

1 product

Vendor	Product	Version
Go standard library	html/template	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Ali Sherif

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:31:30.140536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:32:29.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "html/template",
          "product": "html/template",
          "programRoutines": [
            {
              "name": "tJS"
            },
            {
              "name": "Template.Execute"
            },
            {
              "name": "Template.ExecuteTemplate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ali Sherif"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, pathological inputs could close an unescaped \u0027/\u0027 early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.354Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80435"
        },
        {
          "url": "https://go.dev/cl/807100"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "title": "Fix Javascript regexp context tracking in html/template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56858",
    "datePublished": "2026-08-13T21:58:53.354Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:32:29.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56859 (GCVE-0-2026-56859)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:21

Title

Add recursion depth guard during decode in encoding/xml

Summary

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:21 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/80481
https://go.dev/cl/803320
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6088

Impacted products

1 product

Vendor	Product	Version
Go standard library	encoding/xml	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:21:09.615961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:21:46.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/xml",
          "product": "encoding/xml",
          "programRoutines": [
            {
              "name": "Decoder.push"
            },
            {
              "name": "Decoder.pop"
            },
            {
              "name": "Decoder.RawToken"
            },
            {
              "name": "Decoder.unmarshalPath"
            },
            {
              "name": "Decoder.unmarshal"
            },
            {
              "name": "Decoder.Decode"
            },
            {
              "name": "Decoder.DecodeElement"
            },
            {
              "name": "Decoder.Skip"
            },
            {
              "name": "Decoder.Token"
            },
            {
              "name": "Unmarshal"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:52.959Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80481"
        },
        {
          "url": "https://go.dev/cl/803320"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "title": "Add recursion depth guard during decode in encoding/xml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56859",
    "datePublished": "2026-08-13T21:58:52.959Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:21:46.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56860 (GCVE-0-2026-56860)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:14

Title

Avoid quadratic complexity in resolvePath in net/url

Summary

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:14 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/cl/803681
https://go.dev/issue/80494
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6218

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/url	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:14:34.601382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:14:39.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "resolvePath"
            },
            {
              "name": "URL.Parse"
            },
            {
              "name": "URL.ResolveReference"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.731Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/803681"
        },
        {
          "url": "https://go.dev/issue/80494"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "title": "Avoid quadratic complexity in resolvePath in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56860",
    "datePublished": "2026-08-13T21:58:53.731Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T16:14:39.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56862 (GCVE-0-2026-56862)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:29

Title

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Summary

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:27 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/80528
https://go.dev/cl/804261
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6090

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/tls	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Qi Deng of Aurascape.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:27:34.651997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:29:41.741Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "Conn.readRecordOrCCS"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            },
            {
              "name": "QUICConn.HandleData"
            },
            {
              "name": "QUICConn.Start"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Qi Deng of Aurascape.ai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.216Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80528"
        },
        {
          "url": "https://go.dev/cl/804261"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "title": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56862",
    "datePublished": "2026-08-13T21:58:53.216Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:29:41.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:92303

CVE-2026-106445 (GCVE-0-2026-106445)

CVE-2026-106446 (GCVE-0-2026-106446)

CVE-2026-33818 (GCVE-0-2026-33818)

CVE-2026-39822 (GCVE-0-2026-39822)

CVE-2026-39834 (GCVE-0-2026-39834)

CVE-2026-56853 (GCVE-0-2026-56853)

CVE-2026-56858 (GCVE-0-2026-56858)

CVE-2026-56859 (GCVE-0-2026-56859)

CVE-2026-56860 (GCVE-0-2026-56860)

CVE-2026-56862 (GCVE-0-2026-56862)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour