{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Important"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"Red Hat Web Terminal Operator 1.17.1 has been released.","title":"Topic"},{"category":"general","text":"The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.","title":"Details"},{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"https://access.redhat.com/errata/RHSA-2026:70394","url":"https://access.redhat.com/errata/RHSA-2026:70394"},{"category":"external","summary":"https://access.redhat.com/security/cve/CVE-2026-33818","url":"https://access.redhat.com/security/cve/CVE-2026-33818"},{"category":"external","summary":"https://access.redhat.com/security/cve/CVE-2026-56853","url":"https://access.redhat.com/security/cve/CVE-2026-56853"},{"category":"external","summary":"https://access.redhat.com/security/cve/CVE-2026-56859","url":"https://access.redhat.com/security/cve/CVE-2026-56859"},{"category":"external","summary":"https://access.redhat.com/security/cve/CVE-2026-56860","url":"https://access.redhat.com/security/cve/CVE-2026-56860"},{"category":"external","summary":"https://access.redhat.com/security/cve/CVE-2026-56862","url":"https://access.redhat.com/security/cve/CVE-2026-56862"},{"category":"external","summary":"https://access.redhat.com/security/updates/classification/","url":"https://access.redhat.com/security/updates/classification/"},{"category":"external","summary":"https://redhat.atlassian.net/browse/WTO-523","url":"https://redhat.atlassian.net/browse/WTO-523"},{"category":"external","summary":"https://redhat.atlassian.net/browse/WTO-530","url":"https://redhat.atlassian.net/browse/WTO-530"},{"category":"external","summary":"https://redhat.atlassian.net/browse/WTO-537","url":"https://redhat.atlassian.net/browse/WTO-537"},{"category":"external","summary":"https://redhat.atlassian.net/browse/WTO-544","url":"https://redhat.atlassian.net/browse/WTO-544"},{"category":"external","summary":"https://redhat.atlassian.net/browse/WTO-551","url":"https://redhat.atlassian.net/browse/WTO-551"},{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70394.json"}],"title":"Red Hat Security Advisory: Red Hat Web Terminal Operator 1.17.1 release.","tracking":{"current_release_date":"2026-09-23T05:20:09+00:00","generator":{"date":"2026-09-23T05:20:09+00:00","engine":{"name":"Red Hat SDEngine","version":"5.4.0"}},"id":"RHSA-2026:70394","initial_release_date":"2026-09-22T18:30:16+00:00","revision_history":[{"date":"2026-09-22T18:30:16+00:00","number":"1","summary":"Initial version"},{"date":"2026-09-22T18:30:20+00:00","number":"2","summary":"Last updated version"},{"date":"2026-09-23T05:20:09+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"Red Hat Web Terminal 1.17","product":{"name":"Red Hat Web Terminal 1.17","product_id":"Red Hat Web Terminal 1.17","product_identification_helper":{"cpe":"cpe:/a:redhat:webterminal:1.17::el9"}}}],"category":"product_family","name":"Red Hat Web Terminal"},{"branches":[{"category":"product_version","name":"registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","product":{"name":"registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","product_id":"registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","product_identification_helper":{"purl":"pkg:oci/web-terminal-exec-rhel9@sha256%3A49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98?arch=amd64&repository_url=registry.redhat.io/web-terminal/web-terminal-exec-rhel9&tag=1788989711"}}},{"category":"product_version","name":"registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","product":{"name":"registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","product_id":"registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","product_identification_helper":{"purl":"pkg:oci/web-terminal-rhel9-operator@sha256%3A0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c?arch=amd64&repository_url=registry.redhat.io/web-terminal/web-terminal-rhel9-operator&tag=1788989720"}}},{"category":"product_version","name":"registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","product":{"name":"registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","product_id":"registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","product_identification_helper":{"purl":"pkg:oci/web-terminal-operator-bundle@sha256%3Ab435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce?arch=amd64&repository_url=registry.redhat.io/web-terminal/web-terminal-operator-bundle&tag=1788991020"}}},{"category":"product_version","name":"registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64","product":{"name":"registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64","product_id":"registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64","product_identification_helper":{"purl":"pkg:oci/web-terminal-tooling-rhel9@sha256%3Af985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537?arch=amd64&repository_url=registry.redhat.io/web-terminal/web-terminal-tooling-rhel9&tag=1788989755"}}}],"category":"architecture","name":"amd64"}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64 as a component of Red Hat Web Terminal 1.17","product_id":"Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"},"product_reference":"registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","relates_to_product_reference":"Red Hat Web Terminal 1.17"},{"category":"default_component_of","full_product_name":{"name":"registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64 as a component of Red Hat Web Terminal 1.17","product_id":"Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64"},"product_reference":"registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","relates_to_product_reference":"Red Hat Web Terminal 1.17"},{"category":"default_component_of","full_product_name":{"name":"registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64 as a component of Red Hat Web Terminal 1.17","product_id":"Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64"},"product_reference":"registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","relates_to_product_reference":"Red Hat Web Terminal 1.17"},{"category":"default_component_of","full_product_name":{"name":"registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64 as a component of Red Hat Web Terminal 1.17","product_id":"Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"},"product_reference":"registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64","relates_to_product_reference":"Red Hat Web Terminal 1.17"}]},"vulnerabilities":[{"cve":"CVE-2026-33818","cwe":{"id":"CWE-776","name":"Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')"},"discovery_date":"2026-08-13T22:12:37.151735+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"2515815"}],"notes":[{"category":"description","text":"A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.","title":"Vulnerability description"},{"category":"summary","text":"encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal","title":"Vulnerability summary"},{"category":"other","text":"This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"fixed":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"known_not_affected":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-33818"},{"category":"external","summary":"RHBZ#2515815","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-33818","url":"https://www.cve.org/CVERecord?id=CVE-2026-33818"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818"},{"category":"external","summary":"https://go.dev/cl/814980","url":"https://go.dev/cl/814980"},{"category":"external","summary":"https://go.dev/issue/80405","url":"https://go.dev/issue/80405"},{"category":"external","summary":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"},{"category":"external","summary":"https://pkg.go.dev/vuln/GO-2026-5972","url":"https://pkg.go.dev/vuln/GO-2026-5972"}],"release_date":"2026-08-13T21:58:52.821000+00:00","remediations":[{"category":"vendor_fix","date":"2026-09-22T18:30:16+00:00","details":"To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.22 or higher.","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"restart_required":{"category":"none"},"url":"https://access.redhat.com/errata/RHSA-2026:70394"}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"threats":[{"category":"impact","details":"Important"}],"title":"encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"},{"cve":"CVE-2026-56853","cwe":{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"},"discovery_date":"2026-08-13T22:14:53.561638+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"2515827"}],"notes":[{"category":"description","text":"A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.","title":"Vulnerability description"},{"category":"summary","text":"net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service","title":"Vulnerability summary"},{"category":"other","text":"Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"fixed":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"known_not_affected":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-56853"},{"category":"external","summary":"RHBZ#2515827","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-56853","url":"https://www.cve.org/CVERecord?id=CVE-2026-56853"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853"},{"category":"external","summary":"https://go.dev/cl/795540","url":"https://go.dev/cl/795540"},{"category":"external","summary":"https://go.dev/issue/80205","url":"https://go.dev/issue/80205"},{"category":"external","summary":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"},{"category":"external","summary":"https://pkg.go.dev/vuln/GO-2026-6089","url":"https://pkg.go.dev/vuln/GO-2026-6089"}],"release_date":"2026-08-13T21:58:53.092000+00:00","remediations":[{"category":"vendor_fix","date":"2026-09-22T18:30:16+00:00","details":"To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.22 or higher.","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"restart_required":{"category":"none"},"url":"https://access.redhat.com/errata/RHSA-2026:70394"}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"threats":[{"category":"impact","details":"Important"}],"title":"net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"},{"cve":"CVE-2026-56859","cwe":{"id":"CWE-776","name":"Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')"},"discovery_date":"2026-08-13T22:16:52.493058+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"2515840"}],"notes":[{"category":"description","text":"A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.","title":"Vulnerability description"},{"category":"summary","text":"encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue","title":"Vulnerability summary"},{"category":"other","text":"An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"fixed":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"known_not_affected":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-56859"},{"category":"external","summary":"RHBZ#2515840","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-56859","url":"https://www.cve.org/CVERecord?id=CVE-2026-56859"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859"},{"category":"external","summary":"https://go.dev/cl/803320","url":"https://go.dev/cl/803320"},{"category":"external","summary":"https://go.dev/issue/80481","url":"https://go.dev/issue/80481"},{"category":"external","summary":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"},{"category":"external","summary":"https://pkg.go.dev/vuln/GO-2026-6088","url":"https://pkg.go.dev/vuln/GO-2026-6088"}],"release_date":"2026-08-13T21:58:52.959000+00:00","remediations":[{"category":"vendor_fix","date":"2026-09-22T18:30:16+00:00","details":"To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.22 or higher.","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"restart_required":{"category":"none"},"url":"https://access.redhat.com/errata/RHSA-2026:70394"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"threats":[{"category":"impact","details":"Important"}],"title":"encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"},{"cve":"CVE-2026-56860","cwe":{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"},"discovery_date":"2026-08-13T22:13:18.319384+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"2515820"}],"notes":[{"category":"description","text":"A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.","title":"Vulnerability description"},{"category":"summary","text":"net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution","title":"Vulnerability summary"},{"category":"other","text":"This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments ('..') may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"fixed":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"known_not_affected":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-56860"},{"category":"external","summary":"RHBZ#2515820","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-56860","url":"https://www.cve.org/CVERecord?id=CVE-2026-56860"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860"},{"category":"external","summary":"https://go.dev/cl/803681","url":"https://go.dev/cl/803681"},{"category":"external","summary":"https://go.dev/issue/80494","url":"https://go.dev/issue/80494"},{"category":"external","summary":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"},{"category":"external","summary":"https://pkg.go.dev/vuln/GO-2026-6218","url":"https://pkg.go.dev/vuln/GO-2026-6218"}],"release_date":"2026-08-13T21:58:53.731000+00:00","remediations":[{"category":"vendor_fix","date":"2026-09-22T18:30:16+00:00","details":"To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.22 or higher.","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"restart_required":{"category":"none"},"url":"https://access.redhat.com/errata/RHSA-2026:70394"}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"threats":[{"category":"impact","details":"Important"}],"title":"net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"},{"cve":"CVE-2026-56862","cwe":{"id":"CWE-1050","name":"Excessive Platform Resource Consumption within a Loop"},"discovery_date":"2026-08-13T22:16:41.928450+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"2515839"}],"notes":[{"category":"description","text":"A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.","title":"Vulnerability description"},{"category":"summary","text":"crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages","title":"Vulnerability summary"},{"category":"other","text":"This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"fixed":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"known_not_affected":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-56862"},{"category":"external","summary":"RHBZ#2515839","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-56862","url":"https://www.cve.org/CVERecord?id=CVE-2026-56862"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862"},{"category":"external","summary":"https://go.dev/cl/804261","url":"https://go.dev/cl/804261"},{"category":"external","summary":"https://go.dev/issue/80528","url":"https://go.dev/issue/80528"},{"category":"external","summary":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"},{"category":"external","summary":"https://pkg.go.dev/vuln/GO-2026-6090","url":"https://pkg.go.dev/vuln/GO-2026-6090"}],"release_date":"2026-08-13T21:58:53.216000+00:00","remediations":[{"category":"vendor_fix","date":"2026-09-22T18:30:16+00:00","details":"To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.22 or higher.","product_ids":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64"],"restart_required":{"category":"none"},"url":"https://access.redhat.com/errata/RHSA-2026:70394"}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:49879511a7c78484f9e722dbc1d90504f8d23ef297639383d9526e85e4f8ff98_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b435089281a2b60f9dc91619ea022e6e4f3b3484f875e969522c531446b358ce_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:0a24903fb0e03762a3d701d6713c0dae12c249d7392bfd815312c8835c4dab1c_amd64","Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:f985f3d5a9940b3cf5e231d35973d5295013242d0220756241ed5c2be0744537_amd64"]}],"threats":[{"category":"impact","details":"Important"}],"title":"crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"}]}