RHSA-2026:90330HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security advisory

Published
October 26, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (9)

CVE-2026-73500 →CVE-2026-78669 →CVE-2026-111943 →CVE-2026-56853 →CVE-2026-56858 →CVE-2026-56862 →CVE-2026-33818 →CVE-2026-56852 →CVE-2026-56860 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-73500 — etcd: etcd: Denial of Service via unbounded TLS handshake goroutines CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products16

  • Red Hat OpenStack Platform 16.2
  • collectd-libpod-stats-0:1.0.4-6.2.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • collectd-libpod-stats-0:1.0.4-6.2.el8ost.src as a component of Red Hat OpenStack Platform 16.2
  • collectd-libpod-stats-0:1.0.4-6.2.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • collectd-sensubility-0:0.2.1-1.3.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • collectd-sensubility-0:0.2.1-1.3.el8ost.src as a component of Red Hat OpenStack Platform 16.2
  • collectd-sensubility-0:0.2.1-1.3.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • collectd-sensubility-debuginfo-0:0.2.1-1.3.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • collectd-sensubility-debuginfo-0:0.2.1-1.3.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • etcd-0:3.3.23-25.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • etcd-0:3.3.23-25.el8ost.src as a component of Red Hat OpenStack Platform 16.2
  • etcd-0:3.3.23-25.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • etcd-debuginfo-0:3.3.23-25.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • etcd-debuginfo-0:3.3.23-25.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • etcd-debugsource-0:3.3.23-25.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • etcd-debugsource-0:3.3.23-25.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Restrict network access to the etcd TLS listener to only trusted clients and networks. Configure firewall rules to limit inbound connections to the etcd client port (default 2379) and peer port (default 2380) to authorized hosts. This reduces the attack surface by preventing untrusted network attackers from reaching the vulnerable service. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (12)