RHSA-2026:90758HighCVSS 7.5

Red Hat Security Advisory: LVMS 4.14 Bug Fix and Enhancement update

Published
October 27, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (3)

CVE-2026-33818 →CVE-2026-56860 →CVE-2026-56862 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

🎯 Affected products14

  • Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:64562b0f5182441321aed10c33902228d2e44601509aa8e6a907a45ab3d4338e_amd64 as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:ba1e0b079af26737a4c831c36b48d326eb3fadc75cd3ac66ffd3d0d84c3ccfc1_s390x as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:ce628ea3d33039723a40ab814a36d752e45f179e81461c7c24ce861f4b329a29_arm64 as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:ebb7dbbcc09bc1032e1422da0b234d08c9254b4028cc1e6e30c14395e313686d_ppc64le as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/lvms-operator-bundle@sha256:9663a107dc0de4f7295e557c1073541ee5f7c9841b573965f27877e8b34a9296_amd64 as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:0318e745445d21f9026db885211453a4d91ef14a22b4e9da499285c934cc65bc_ppc64le as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:26854939f8fb222f5f2652ebc348713e3488b0a428b741a3552ce6757c82ac1e_amd64 as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:2b4f21496c627e64fa9123cad86306d3bdfe995de5db49af0f77b90560917ddc_arm64 as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:90501cb5cd69ccb80959d7cf0bffbb9a5120333da74feae0fd6811f4cae55f34_s390x as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/topolvm-rhel9@sha256:411e5fd0a8c2c5c4e51ce5e768467a262ff66c119c06796767577abf18d0c846_ppc64le as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/topolvm-rhel9@sha256:5096feecec3cd0251a402cb8fcb81b2dd3346a0bff889e863a99a9538045f834_s390x as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/topolvm-rhel9@sha256:6a1326a496be64b874105a54f51d93dc4dde384d27a205e14084f651e9c9499e_amd64 as a component of Logical Volume Manager Storage 4.14
  • registry.redhat.io/lvms4/topolvm-rhel9@sha256:ff3ee48289c48ecc2ed0c547a5def612473f58b54998f7fce14c4f05d85db634_arm64 as a component of Logical Volume Manager Storage 4.14

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (6)