RHSA-2025%3A0775 — Vulnetix

RHSA-2025%3A0775 PUBLISHED CVSS 7.5 HIGH

A flaw was found in golang.org/x/net/html. This flaw allows an attacker to craft input to the parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This issue can cause a denial of service.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Red Hat	odf4/cephcsi-rhel9@sha256:cd10c218e8398523fffd8710a2245b1ccb7df6c8c30e0864dd6afcc72a4defdc_amd64 as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/rook-ceph-operator-bundle@sha256:ca07d884ec386e595e4992df95f20df988712cd039d39cf39a482c00d3c4c0e6_s390x as a component of RHODF 4.17 for RHEL 9	odf4/rook-ceph-operator-bundle@sha256:ca07d884ec386e595e4992df95f20df988712cd039d39cf39a482c00d3c4c0e6_s390x
Red Hat	odf4/ocs-rhel9-operator@sha256:12270f1aae2f96473b554089c0587e5c3d7c200b4f58dbce395e63fba2d00a1e_amd64 as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/odf-csi-addons-sidecar-rhel9@sha256:b96c6d7062d7e68b3b14f0aa1b0f54e1adc7909a988bf1e008bb906485c00a60_ppc64le as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/odf-cli-rhel9@sha256:6ae43e76662b18eb98e1a4b4b6335908e0c0af68a7a06ec02048e213cc9161fe_amd64 as a component of RHODF 4.17 for RHEL 9	*
Red Hat	odf4/odf-must-gather-rhel9@sha256:e5c3167f3a92c5863fcdf2b8a2bf8d7f1572321b70f3cb6a7e73a892e69170b4_arm64 as a component of RHODF 4.17 for RHEL 9	*
Red Hat	odf4/mcg-operator-bundle@sha256:dd5a29213b5b9df50000e9b8476234c6dda06f4ba383ac39ca18dce9558d4c8d_amd64 as a component of RHODF 4.17 for RHEL 9	odf4/mcg-operator-bundle@sha256:dd5a29213b5b9df50000e9b8476234c6dda06f4ba383ac39ca18dce9558d4c8d_amd64
Red Hat	odf4/mcg-operator-bundle@sha256:31c28061e59fda1bb0833f41bce95839bd9853d14e5bf1c8e02e903b01ee3651_s390x as a component of RHODF 4.17 for RHEL 9	odf4/mcg-operator-bundle@sha256:31c28061e59fda1bb0833f41bce95839bd9853d14e5bf1c8e02e903b01ee3651_s390x
Red Hat	odf4/odf-csi-addons-rhel9-operator@sha256:aafcd624387c80fe60aac74999bc4f98b11cc3193dc7fb3a5d1f5afba432ddd4_s390x as a component of RHODF 4.17 for RHEL 9	*
Red Hat	odf4/odf-csi-addons-rhel9-operator@sha256:70dd217b9700887b6de6d10015f4d665c2dc7217e461899e086441b2e6f80ad3_amd64 as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/odr-hub-operator-bundle@sha256:17aab60e5f979fc0db5662314b610ca3e94411bf4623170b844a92ac3410dd54_ppc64le as a component of RHODF 4.17 for RHEL 9	odf4/odr-hub-operator-bundle@sha256:17aab60e5f979fc0db5662314b610ca3e94411bf4623170b844a92ac3410dd54_ppc64le
Red Hat	odf4/ocs-rhel9-operator@sha256:2c70d4f70f7d21c402aa20fb5cf968589aa9a12c15551e199901a601084d4d8e_s390x as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/odf-rhel9-operator@sha256:1567b45f6892383e2c52f7c89b43608107e8fb2e9d6e502b0f19f529262509a3_ppc64le as a component of RHODF 4.17 for RHEL 9	odf4/odf-rhel9-operator@sha256:1567b45f6892383e2c52f7c89b43608107e8fb2e9d6e502b0f19f529262509a3_ppc64le
Red Hat	odf4/mcg-rhel9-operator@sha256:a0e69ef5e79fef4ef3a989777c1016c6f265d45e6a93213cd1a18cf0772fa821_s390x as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/odf-console-rhel9@sha256:89db4dd9079dea23888beb926544585024f0d4f5bee9e582350fc951ff2acf7d_ppc64le as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/odf-multicluster-console-rhel9@sha256:8bba409b33b95f1f2ecbf35def39b9337a829b75fd9feef1c98ae02de98eafc5_amd64 as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/odr-hub-operator-bundle@sha256:adf0c8cbc58310b672cca18022fc6fea7ef076eace1919b897b8419624891ce7_amd64 as a component of RHODF 4.17 for RHEL 9	*
Red Hat	odf4/odf-operator-bundle@sha256:52f89973825cc34b3080fcfe6f384f683a0a0cbae1f411231a278aa3ece24b08_s390x as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/cephcsi-operator-bundle@sha256:f662e9fc3db6baec5854d8f3e3d64b99021777e9218bd391e0273c114e88ab6b_s390x as a component of RHODF 4.17 for RHEL 9	, , *
Red Hat	odf4/odf-cosi-sidecar-rhel9@sha256:6ce5185f87075ab348e03d8b6f0a3cb88ad6988bf73b82f9107e3207640cfab5_ppc64le as a component of RHODF 4.17 for RHEL 9	, , *

…and 192 more

Timeline

Jan 28, 2025 CVE Published
Apr 25, 2026 Distribution Patch
Apr 25, 2026 Distribution Patch
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Jul 19, 2026 CVE Updated

References

https://access.redhat.com/errata/RHSA-2025:0775 advisory
https://access.redhat.com/security/updates/classification/#important advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2330689 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
https://issues.redhat.com/browse/DFBUGS-1342 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0775.json advisory
https://access.redhat.com/security/cve/CVE-2024-45338 advisory
https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
https://go.dev/cl/637536 advisory
https://go.dev/issue/70906 advisory
https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ advisory
https://pkg.go.dev/vuln/GO-2024-3333 advisory
https://access.redhat.com/security/cve/CVE-2024-52798 advisory
https://www.cve.org/CVERecord?id=CVE-2024-52798 advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-52798 advisory
https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4 advisory
https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w advisory

Open in Interactive Console →