VDB
RHSA-2026%3A6184
RHSA-2026%3A6184
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/odf4/mcg-core-rhel9@sha256:8d7acef03cd20033ef81f7e7bb27f0724935bdccfdfd0fc25fc845a7fcc403e0_ppc64le as a component of Red Hat Openshift Data Foundation 4.19 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:b900f16da0323de026da5daff7062cade07197cfbe1689f7e275e716ff97f3ac_amd64 as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:b900f16da0323de026da5daff7062cade07197cfbe1689f7e275e716ff97f3ac_amd64, registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:b900f16da0323de026da5daff7062cade07197cfbe1689f7e275e716ff97f3ac_amd64, registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:b900f16da0323de026da5daff7062cade07197cfbe1689f7e275e716ff97f3ac_amd64 |
| Red Hat | registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:008fef7f9ae19e47818f18cfa53c4c9f2a39697ed7f052bf68a632742f90186f_ppc64le as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:008fef7f9ae19e47818f18cfa53c4c9f2a39697ed7f052bf68a632742f90186f_ppc64le, registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:008fef7f9ae19e47818f18cfa53c4c9f2a39697ed7f052bf68a632742f90186f_ppc64le, registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:008fef7f9ae19e47818f18cfa53c4c9f2a39697ed7f052bf68a632742f90186f_ppc64le |
| Red Hat | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:077137531fbebfda3f071186eee0623f2b2dfe55933774d0957259217fd5a4aa_ppc64le as a component of Red Hat Openshift Data Foundation 4.19 | *, *, registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:077137531fbebfda3f071186eee0623f2b2dfe55933774d0957259217fd5a4aa_ppc64le |
| Red Hat | registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:1bc385728aef2749bab029cf21c795d19c4be2f6259f87e88af306d90baaed23_arm64 as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:1bc385728aef2749bab029cf21c795d19c4be2f6259f87e88af306d90baaed23_arm64, registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:1bc385728aef2749bab029cf21c795d19c4be2f6259f87e88af306d90baaed23_arm64, registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:1bc385728aef2749bab029cf21c795d19c4be2f6259f87e88af306d90baaed23_arm64 |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:bf9ab046a7fb04dc5f6a18579de25db8913272a6d6e44104721357a0f8052df9_s390x as a component of Red Hat Openshift Data Foundation 4.19 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odr-cluster-operator-bundle@sha256:146ef0d616706b3b6f4f256a59d2db6da13ba8f7c66fc8a6cf57c34e1177af5d_amd64 as a component of Red Hat Openshift Data Foundation 4.19 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:e41a49307c08650cd104ac387a2acc70436870c69eaa98e1cb7508215bc6ae2c_amd64 as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:e41a49307c08650cd104ac387a2acc70436870c69eaa98e1cb7508215bc6ae2c_amd64, *, registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:e41a49307c08650cd104ac387a2acc70436870c69eaa98e1cb7508215bc6ae2c_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:ee97f1400b62d04af173477ee8f0f503621cb501a0803df7d1ef3eeb0a9ee7c2_amd64 as a component of Red Hat Openshift Data Foundation 4.19 | *, registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:ee97f1400b62d04af173477ee8f0f503621cb501a0803df7d1ef3eeb0a9ee7c2_amd64, registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:ee97f1400b62d04af173477ee8f0f503621cb501a0803df7d1ef3eeb0a9ee7c2_amd64 |
| Red Hat | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:077137531fbebfda3f071186eee0623f2b2dfe55933774d0957259217fd5a4aa_ppc64le as a component of Red Hat Openshift Data Foundation 4.19 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:1a35d685a9488bc395bc523f2203a50d5404f7b15cc133ace95f093d7f1d0955_arm64 as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:1a35d685a9488bc395bc523f2203a50d5404f7b15cc133ace95f093d7f1d0955_arm64, registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:1a35d685a9488bc395bc523f2203a50d5404f7b15cc133ace95f093d7f1d0955_arm64, registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:1a35d685a9488bc395bc523f2203a50d5404f7b15cc133ace95f093d7f1d0955_arm64 |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:ae777911c6129b2cc15f7aa26e8be308e4aab1909c710287285e548d51ec2f6e_arm64 as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:ae777911c6129b2cc15f7aa26e8be308e4aab1909c710287285e548d51ec2f6e_arm64, registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:ae777911c6129b2cc15f7aa26e8be308e4aab1909c710287285e548d51ec2f6e_arm64, registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:ae777911c6129b2cc15f7aa26e8be308e4aab1909c710287285e548d51ec2f6e_arm64 |
| Red Hat | registry.redhat.io/odf4/odr-recipe-operator-bundle@sha256:527cea3e59277739f736511efda8b7a22b4c9e7576e8f7e4c06b36bba338de54_amd64 as a component of Red Hat Openshift Data Foundation 4.19 | *, *, registry.redhat.io/odf4/odr-recipe-operator-bundle@sha256:527cea3e59277739f736511efda8b7a22b4c9e7576e8f7e4c06b36bba338de54_amd64 |
| Red Hat | registry.redhat.io/odf4/ocs-rhel9-operator@sha256:6327c16c8f5575296145de293f141848223a28a213fa255e53e25ca7a8b8c935_s390x as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/ocs-rhel9-operator@sha256:6327c16c8f5575296145de293f141848223a28a213fa255e53e25ca7a8b8c935_s390x, registry.redhat.io/odf4/ocs-rhel9-operator@sha256:6327c16c8f5575296145de293f141848223a28a213fa255e53e25ca7a8b8c935_s390x, registry.redhat.io/odf4/ocs-rhel9-operator@sha256:6327c16c8f5575296145de293f141848223a28a213fa255e53e25ca7a8b8c935_s390x |
| Red Hat | registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:1e1c090a1a2a9a4ecd41b3e70c16a1a26c6e24505babcc04af57dfdd6a874c2b_amd64 as a component of Red Hat Openshift Data Foundation 4.19 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odr-recipe-operator-bundle@sha256:527cea3e59277739f736511efda8b7a22b4c9e7576e8f7e4c06b36bba338de54_amd64 | |
| golang | go | |
| Red Hat | registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:1e1c090a1a2a9a4ecd41b3e70c16a1a26c6e24505babcc04af57dfdd6a874c2b_amd64 as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:1e1c090a1a2a9a4ecd41b3e70c16a1a26c6e24505babcc04af57dfdd6a874c2b_amd64, registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:1e1c090a1a2a9a4ecd41b3e70c16a1a26c6e24505babcc04af57dfdd6a874c2b_amd64, registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:1e1c090a1a2a9a4ecd41b3e70c16a1a26c6e24505babcc04af57dfdd6a874c2b_amd64 |
| Red Hat | registry.redhat.io/odf4/mcg-rhel9-operator@sha256:acdca139d9b87e53cdadd79d6f22bd67ca8417fbd13014e5773a49f45da88983_s390x as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/mcg-rhel9-operator@sha256:acdca139d9b87e53cdadd79d6f22bd67ca8417fbd13014e5773a49f45da88983_s390x, registry.redhat.io/odf4/mcg-rhel9-operator@sha256:acdca139d9b87e53cdadd79d6f22bd67ca8417fbd13014e5773a49f45da88983_s390x, registry.redhat.io/odf4/mcg-rhel9-operator@sha256:acdca139d9b87e53cdadd79d6f22bd67ca8417fbd13014e5773a49f45da88983_s390x |
| Red Hat | registry.redhat.io/odf4/mcg-core-rhel9@sha256:081b4ae6d4cd30faea2600d345df27f8a117cf80b263598ee6010925efb7c00a_s390x as a component of Red Hat Openshift Data Foundation 4.19 | registry.redhat.io/odf4/mcg-core-rhel9@sha256:081b4ae6d4cd30faea2600d345df27f8a117cf80b263598ee6010925efb7c00a_s390x, registry.redhat.io/odf4/mcg-core-rhel9@sha256:081b4ae6d4cd30faea2600d345df27f8a117cf80b263598ee6010925efb7c00a_s390x, registry.redhat.io/odf4/mcg-core-rhel9@sha256:081b4ae6d4cd30faea2600d345df27f8a117cf80b263598ee6010925efb7c00a_s390x |
…and 178 more
Timeline
- Mar 30, 2026 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jul 29, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:6184 advisory
- https://access.redhat.com/security/cve/CVE-2025-61726 advisory
- https://access.redhat.com/security/cve/CVE-2025-61729 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6184.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2434432 issue
- https://www.cve.org/CVERecord?id=CVE-2025-61726 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61726 advisory
- https://go.dev/cl/736712 advisory
- https://go.dev/issue/77101 advisory
- https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc advisory
- https://pkg.go.dev/vuln/GO-2026-4341 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418462 issue
- https://www.cve.org/CVERecord?id=CVE-2025-61729 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61729 advisory
- https://go.dev/cl/725920 advisory
- https://go.dev/issue/76445 advisory
- https://groups.google.com/g/golang-announce/c/8FJoBkPddm4 advisory
- https://pkg.go.dev/vuln/GO-2025-4155 advisory