VDB
RHSA-2026%3A4435
RHSA-2026%3A4435
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:30564f1bfc34991ef0886ba7ab4fca123c65320f24813b340e7f379e9bc2ef40_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:30564f1bfc34991ef0886ba7ab4fca123c65320f24813b340e7f379e9bc2ef40_ppc64le, registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:30564f1bfc34991ef0886ba7ab4fca123c65320f24813b340e7f379e9bc2ef40_ppc64le, registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:30564f1bfc34991ef0886ba7ab4fca123c65320f24813b340e7f379e9bc2ef40_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:d603323b102ab9c0fbd33ac535dc4ee9f1ed80abeb8788cbbafedd56993f8944_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:d603323b102ab9c0fbd33ac535dc4ee9f1ed80abeb8788cbbafedd56993f8944_amd64, registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:d603323b102ab9c0fbd33ac535dc4ee9f1ed80abeb8788cbbafedd56993f8944_amd64 |
| Red Hat | OpenShift Container Platform | |
| Red Hat | registry.redhat.io/openshift4/ptp-must-gather-rhel9@sha256:a4c1c7871d60af3618f783989023db26e5dafee7e9c542b9af8b0400a97acbee_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ptp-must-gather-rhel9@sha256:a4c1c7871d60af3618f783989023db26e5dafee7e9c542b9af8b0400a97acbee_ppc64le, registry.redhat.io/openshift4/ptp-must-gather-rhel9@sha256:a4c1c7871d60af3618f783989023db26e5dafee7e9c542b9af8b0400a97acbee_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:68c8cc732d9461e40d00f4fa46c96e55024143d6ccfa785a59f5cccd2c40a26c_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:68c8cc732d9461e40d00f4fa46c96e55024143d6ccfa785a59f5cccd2c40a26c_amd64, registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:68c8cc732d9461e40d00f4fa46c96e55024143d6ccfa785a59f5cccd2c40a26c_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-egress-dns-proxy-rhel9@sha256:f7a2d03adc8094aaea39c309d9688b51cdbc2636895d6dfc442da4f69002b05f_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ose-egress-dns-proxy-rhel9@sha256:f7a2d03adc8094aaea39c309d9688b51cdbc2636895d6dfc442da4f69002b05f_amd64, registry.redhat.io/openshift4/ose-egress-dns-proxy-rhel9@sha256:f7a2d03adc8094aaea39c309d9688b51cdbc2636895d6dfc442da4f69002b05f_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:0ccd6a58363700b8f952f5124b1996e2bf78863e48695d520a47d573fd5233aa_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:29bbf23c4c6c5e00887d8b937d639e3d1b94c1124a37b2b23bb2e4f290ba5cfd_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:29bbf23c4c6c5e00887d8b937d639e3d1b94c1124a37b2b23bb2e4f290ba5cfd_ppc64le, registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:29bbf23c4c6c5e00887d8b937d639e3d1b94c1124a37b2b23bb2e4f290ba5cfd_ppc64le, registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:29bbf23c4c6c5e00887d8b937d639e3d1b94c1124a37b2b23bb2e4f290ba5cfd_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:86c63a77869f6984688619c4add438e4853684a4e6ceb80d69d2cacb59fe9d57_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:86c63a77869f6984688619c4add438e4853684a4e6ceb80d69d2cacb59fe9d57_ppc64le, registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:86c63a77869f6984688619c4add438e4853684a4e6ceb80d69d2cacb59fe9d57_ppc64le, registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:86c63a77869f6984688619c4add438e4853684a4e6ceb80d69d2cacb59fe9d57_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:450483b1350cf132985dc7fdf744a3850338afb2d9ce5e57962ae489c9acc47b_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:450483b1350cf132985dc7fdf744a3850338afb2d9ce5e57962ae489c9acc47b_arm64, registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:450483b1350cf132985dc7fdf744a3850338afb2d9ce5e57962ae489c9acc47b_arm64, registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:450483b1350cf132985dc7fdf744a3850338afb2d9ce5e57962ae489c9acc47b_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:7c0a928585dc0f62ddb7a499696d7b38d948b79131f7fa029339fe1d9524de7d_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:7c0a928585dc0f62ddb7a499696d7b38d948b79131f7fa029339fe1d9524de7d_ppc64le, registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:7c0a928585dc0f62ddb7a499696d7b38d948b79131f7fa029339fe1d9524de7d_ppc64le, registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:7c0a928585dc0f62ddb7a499696d7b38d948b79131f7fa029339fe1d9524de7d_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:3f453bb1eeea303de945fb9d61607d604090d830b69e085e54a342e680e3711c_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:3f453bb1eeea303de945fb9d61607d604090d830b69e085e54a342e680e3711c_amd64, registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:3f453bb1eeea303de945fb9d61607d604090d830b69e085e54a342e680e3711c_amd64, registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:3f453bb1eeea303de945fb9d61607d604090d830b69e085e54a342e680e3711c_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:51be2510cb54dc0a867f781f911ff1f1e1a6b5043b323b97e41cfb3de8bd1261_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:51be2510cb54dc0a867f781f911ff1f1e1a6b5043b323b97e41cfb3de8bd1261_arm64, registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:51be2510cb54dc0a867f781f911ff1f1e1a6b5043b323b97e41cfb3de8bd1261_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:66e44ba127cc8cd6afb75034aa24aba557e570529878c2f3aafba43d819d057b_s390x as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:66e44ba127cc8cd6afb75034aa24aba557e570529878c2f3aafba43d819d057b_s390x, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:d8710f769f0c69b72a3d83bf56a1d9a35dcc6e78b6ffe824d2722770ad33142f_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:d8710f769f0c69b72a3d83bf56a1d9a35dcc6e78b6ffe824d2722770ad33142f_arm64, *, registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:d8710f769f0c69b72a3d83bf56a1d9a35dcc6e78b6ffe824d2722770ad33142f_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9@sha256:5b983334b6e84798aadf296485109a770b5096bf3cd9b5fd030d0bb7cd2d96a7_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9@sha256:dcefffa10e2a95a17c9e164df185bb445a20c1a9d5bfb08903f0c72f8934d2ee_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9@sha256:dcefffa10e2a95a17c9e164df185bb445a20c1a9d5bfb08903f0c72f8934d2ee_ppc64le, registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9@sha256:dcefffa10e2a95a17c9e164df185bb445a20c1a9d5bfb08903f0c72f8934d2ee_ppc64le, registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9@sha256:dcefffa10e2a95a17c9e164df185bb445a20c1a9d5bfb08903f0c72f8934d2ee_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:74d99d28b1e4f8db0d7546cd4d26ed443950076154f3d1be4dee3bbc316fc617_s390x as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:74d99d28b1e4f8db0d7546cd4d26ed443950076154f3d1be4dee3bbc316fc617_s390x, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:ae6393a6082abf8d55dbb3607f7144ac0407d6c50c212e0ef9f36cb329131203_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-egress-router-rhel9@sha256:6bf57a0677212fa794de6adf1fde3418b2bbf09a5479d9610fac58e311c11e00_s390x as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-egress-router-rhel9@sha256:6bf57a0677212fa794de6adf1fde3418b2bbf09a5479d9610fac58e311c11e00_s390x, registry.redhat.io/openshift4/ose-egress-router-rhel9@sha256:6bf57a0677212fa794de6adf1fde3418b2bbf09a5479d9610fac58e311c11e00_s390x, registry.redhat.io/openshift4/ose-egress-router-rhel9@sha256:6bf57a0677212fa794de6adf1fde3418b2bbf09a5479d9610fac58e311c11e00_s390x |
…and 356 more
Timeline
- Mar 18, 2026 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jul 17, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:4435 advisory
- https://access.redhat.com/security/cve/CVE-2025-61726 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4435.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2434432 issue
- https://www.cve.org/CVERecord?id=CVE-2025-61726 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61726 advisory
- https://go.dev/cl/736712 advisory
- https://go.dev/issue/77101 advisory
- https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc advisory
- https://pkg.go.dev/vuln/GO-2026-4341 advisory