VDB
RHSA-2026%3A17598
RHSA-2026%3A17598
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-rhel9-operator@sha256:65510cbf476c28abb5399068f41d9596eab02cf173286a0b6438f474415fab75_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-coredns-rhel9@sha256:0249321be6a2ff6ba895136270c33e882e2ef1214f03144291db4685ddc6633b_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-whereabouts-ipam-cni-rhel9@sha256:4f54adb299bacc97ea8d0418cd0bf61903f4f797cd883e33716e30be22d3cfec_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:3f525a20f281900474b6403276709bf3f7a3bbb702e2992f52395e2ac79f5f5a_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-installer-altinfra-rhel9@sha256:35d6de2a67e7a69c221376ac29de88671b4751c9d4a250fc2f38df5a331265fb_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:777f88c47ee7dfb5846ff17bed7dc8bc3d4d32e6113447c6219a80eb6440e24e_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:127b3f97a24c6df6a85744795b1b3daa4ad7d54ec535e395e0b3ba4483476cc1_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-block-csi-driver-rhel9@sha256:efe748a02ebd4eec3930e67a7231d4bafd2ee4f27d28197014a45e6e396fd568_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-cluster-api-controllers-rhel9@sha256:60e93ff5a441129df2362136bb24aba30d8c2c22634f5f85c3f1708b58dec037_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-pod-rhel9@sha256:b0d50636515e3f2c7ecdd7f06feaeb3cf62bb44ffdee2b65f2ad31a52d5f9a71_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9-operator@sha256:bcde14befd9c67991fb7747fe93c8325aa77a363a67f3f854b2fbe6c8fec5f71_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-network-rhel9-operator@sha256:d0ae45ee6e982bca0e9e36f802cef423e8a9788a454daa1f5ea456d0fdd8b2c1_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-runtimecfg-rhel9@sha256:2cc51274699c5aec200014e960bd4663b04d7fb6ef4d0c0e10885d66598493b8_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-server-rhel9@sha256:325e333e7db4ed7405adbe5e4cc2b77e53e3e8238edb0e61bba7abb623c3f7ce_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-machine-controllers-rhel9@sha256:10be2730c754cea79ffe32f9ce3bdccfb357c5f0b8e9ed33a31651f2db985079_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:a54b92276c0614f31613249c8523095faf091a24a482d22bb0086b2fd1a07756_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-console-rhel9@sha256:4f2961ab6f5ecb67fe581752e311302fc1f3e8374a5bc6e88b617a1c525d41b3_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-installer-rhel9@sha256:0888119c7aaef59dc7d7eaa1d87d154e445aaf1160582a6a7919f9fe176bed67_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:156d80b2bb8a1b0b78ef6178c4aa23cb3568a77766d60e4819b015cc6a250951_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:78591decca98a250bb0833925ac810cb2b8b5b79291c99ac153032984e3d2683_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
…and 647 more
Timeline
- May 20, 2026 CVE Published
- May 21, 2026 Distribution Patch
- May 21, 2026 Distribution Patch
- May 21, 2026 Security Advisory
- May 21, 2026 Security Advisory
- May 21, 2026 Security Advisory
- May 21, 2026 Security Advisory
- May 21, 2026 Security Advisory
- May 21, 2026 Security Advisory
- May 21, 2026 Security Advisory
- May 21, 2026 Security Advisory
- May 21, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:17598 advisory
- https://access.redhat.com/security/cve/CVE-2025-61726 advisory
- https://access.redhat.com/security/cve/CVE-2025-61728 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 advisory
- https://access.redhat.com/security/cve/CVE-2026-29063 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/cve/CVE-2026-34986 advisory
- https://access.redhat.com/security/cve/CVE-2026-35469 advisory
- https://access.redhat.com/security/cve/CVE-2026-4800 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17598.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2434432 issue
- https://www.cve.org/CVERecord?id=CVE-2025-61726 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61726 advisory
- https://go.dev/cl/736712 advisory
- https://go.dev/issue/77101 advisory
- https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc advisory
- https://pkg.go.dev/vuln/GO-2026-4341 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2434431 issue
…and 70 more