RHSA-2026:91216HighCVSS 7.5
Red Hat Security Advisory: Red Hat Cost Management On-Premise container image update
🔗 CVE IDs covered (3)
📋 Description
CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
🎯 Affected products2
- Red Hat Cost Management On-Premise 1
- registry.redhat.io/costmanagement/costmanagement-ingress-rhel9@sha256:58bcb61c40b0c1b44f613608ec30d857b1d5e4c633b6982a83fdb6064b79d941_amd64 as a component of Red Hat Cost Management On-Premise 1
✅ Remediation
The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
🔗 References (9)
- selfhttps://access.redhat.com/errata/RHSA-2026:91216
- externalhttps://access.redhat.com/articles/7148128
- externalhttps://access.redhat.com/security/cve/CVE-2026-56859
- externalhttps://access.redhat.com/security/cve/CVE-2026-56860
- externalhttps://access.redhat.com/security/cve/CVE-2026-84445
- externalhttps://access.redhat.com/security/updates/classification
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91216.json