VDB
RHSA-2026%3A6251
RHSA-2026%3A6251
PUBLISHED
CVSS 7.5 HIGH
Record from redhat · Published March 31, 2026
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
Risk scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/oadp/oadp-velero-rhel9@sha256:575263c5c4228fc54ca4dd33605588b37e6ffdd08af5344d19feaa421701e267_arm64 as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-velero-rhel9@sha256:575263c5c4228fc54ca4dd33605588b37e6ffdd08af5344d19feaa421701e267_arm64 |
| Red Hat | registry.redhat.io/oadp/oadp-operator-bundle@sha256:7bba26e14098763c7d2989489357246b8ba280ac88d84f9ddc688541b852a527_amd64 as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-operator-bundle@sha256:7bba26e14098763c7d2989489357246b8ba280ac88d84f9ddc688541b852a527_amd64, * |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:a19c3cfecd1120e366c3aeff5157c1fa1487b4f97bc8a44513dc87e5193874af_amd64 as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:a19c3cfecd1120e366c3aeff5157c1fa1487b4f97bc8a44513dc87e5193874af_amd64, * |
| Red Hat | registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d24718a7e522d1307a42b93b13c3f9c6f4e9755af9f47569373e541bbe0c47d4_ppc64le as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d24718a7e522d1307a42b93b13c3f9c6f4e9755af9f47569373e541bbe0c47d4_ppc64le, * |
| Red Hat | registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d24718a7e522d1307a42b93b13c3f9c6f4e9755af9f47569373e541bbe0c47d4_ppc64le as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d24718a7e522d1307a42b93b13c3f9c6f4e9755af9f47569373e541bbe0c47d4_ppc64le, * |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:24af970befaecfcf1082f6f1c1a14d043db87c391cdb45cb4d81d63c05391f4f_ppc64le as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:24af970befaecfcf1082f6f1c1a14d043db87c391cdb45cb4d81d63c05391f4f_ppc64le |
| Red Hat | registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9949e4981559a98a6b3891ef9c2b96eb0719d787eed3ace91a48b3263c0a84ff_amd64 as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9949e4981559a98a6b3891ef9c2b96eb0719d787eed3ace91a48b3263c0a84ff_amd64 |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6c0ccbe623e43245e786e2a8fa45733303f8c67c60c90880c3fc3d27ae1844c1_amd64 as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6c0ccbe623e43245e786e2a8fa45733303f8c67c60c90880c3fc3d27ae1844c1_amd64 |
| Red Hat | registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:348e808f4365f76af9468136fb05d876a91fb3341ea87ac4478ef3b19f820a59_amd64 as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:348e808f4365f76af9468136fb05d876a91fb3341ea87ac4478ef3b19f820a59_amd64 |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:66a95b0f76a04d62657b48241eb9f48c0b8e80b345db6189b7a5eb4ac8fb614b_s390x as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:66a95b0f76a04d62657b48241eb9f48c0b8e80b345db6189b7a5eb4ac8fb614b_s390x, * |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:8c095de3d93c13b4977624aad7f81bcd482109be69d0b58bef25ebd24d87b526_ppc64le as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:8c095de3d93c13b4977624aad7f81bcd482109be69d0b58bef25ebd24d87b526_ppc64le |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6c0ccbe623e43245e786e2a8fa45733303f8c67c60c90880c3fc3d27ae1844c1_amd64 as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6c0ccbe623e43245e786e2a8fa45733303f8c67c60c90880c3fc3d27ae1844c1_amd64 |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5645ed983ced9b12f35e53b02dc7560e164949190d1bfce8df31b2d3ade3a0ab_arm64 as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5645ed983ced9b12f35e53b02dc7560e164949190d1bfce8df31b2d3ade3a0ab_arm64, * |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:c46a5ca1980e56e18b670875e6598494539a7fef88fe5e7316e7e4c1f9c5b05b_s390x as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:c46a5ca1980e56e18b670875e6598494539a7fef88fe5e7316e7e4c1f9c5b05b_s390x |
| Red Hat | registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:713a90e0460a0739f6a173413b7b4a4f007b9dc385a13d473eb90f42fc8488dc_amd64 as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:713a90e0460a0739f6a173413b7b4a4f007b9dc385a13d473eb90f42fc8488dc_amd64 |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c92212fdcaeb3a88d67026d3b564960b0fae2e23a72f28ed6466307f7aa43c75_arm64 as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c92212fdcaeb3a88d67026d3b564960b0fae2e23a72f28ed6466307f7aa43c75_arm64 |
| Red Hat | registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:348e808f4365f76af9468136fb05d876a91fb3341ea87ac4478ef3b19f820a59_amd64 as a component of OpenShift API for Data Protection 1.4 | registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:348e808f4365f76af9468136fb05d876a91fb3341ea87ac4478ef3b19f820a59_amd64, * |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c93ea18feae62cf85a75c40782e79dd471bd1d814f919c62242c7e2d660b4c6_s390x as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c93ea18feae62cf85a75c40782e79dd471bd1d814f919c62242c7e2d660b4c6_s390x |
| Red Hat | registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c175aaa7d6090900667715414322689f61b1c2d8d6210390adef9f37513467ed_s390x as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c175aaa7d6090900667715414322689f61b1c2d8d6210390adef9f37513467ed_s390x |
| Red Hat | registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:0c33be54cc7f4edb28f4014e8c1a10e2ebdcbff4d0b7db45c20339fd2d4f6a44_ppc64le as a component of OpenShift API for Data Protection 1.4 | *, registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:0c33be54cc7f4edb28f4014e8c1a10e2ebdcbff4d0b7db45c20339fd2d4f6a44_ppc64le |
…and 62 more
Timeline
- Mar 31, 2026 CVE Published
- Sep 19, 2026 CVE Updated
- Sep 19, 2026 Distribution Patch (2 in total, the first dated here)
- Sep 19, 2026 Security Advisory (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2026%3A6251
vulnetix vdb fixes RHSA-2026%3A6251Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%253A6251/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/errata/RHSA-2026:6251 advisory
- https://access.redhat.com/security/cve/CVE-2025-61726 advisory
- https://access.redhat.com/security/cve/CVE-2025-61728 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6251.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2434432 issue
- https://www.cve.org/CVERecord?id=CVE-2025-61726 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61726 advisory
- https://go.dev/cl/736712 advisory
- https://go.dev/issue/77101 advisory
- https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc advisory
- https://pkg.go.dev/vuln/GO-2026-4341 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2434431 issue
- https://www.cve.org/CVERecord?id=CVE-2025-61728 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61728 advisory
- https://go.dev/cl/736713 advisory
- https://go.dev/issue/77102 advisory
- https://pkg.go.dev/vuln/GO-2026-4342 advisory