RHSA-2026%3A8167 | Vulnetix

RHSA-2026%3A8167 PUBLISHED CVSS 7.400000095367432 HIGH

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.

Risk Scores

CVSS 3.1

7.400000095367432

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions


Red Hat	registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:1a4e4ddfdd6f353c67172dec6b6d5e3c07d3f67410d537066e2b0321b044698a_amd64 as a component of Red Hat Web Terminal 1.15	registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:1a4e4ddfdd6f353c67172dec6b6d5e3c07d3f67410d537066e2b0321b044698a_amd64, registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:1a4e4ddfdd6f353c67172dec6b6d5e3c07d3f67410d537066e2b0321b044698a_amd64, registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:1a4e4ddfdd6f353c67172dec6b6d5e3c07d3f67410d537066e2b0321b044698a_amd64
Red Hat	registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:a531c9a89a0ddf261241c353de8866f6609b535e3dbaf05bf3ff410234398d7b_amd64 as a component of Red Hat Web Terminal 1.15	registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:a531c9a89a0ddf261241c353de8866f6609b535e3dbaf05bf3ff410234398d7b_amd64, registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:a531c9a89a0ddf261241c353de8866f6609b535e3dbaf05bf3ff410234398d7b_amd64, registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:a531c9a89a0ddf261241c353de8866f6609b535e3dbaf05bf3ff410234398d7b_amd64
Go	Go standard library
Red Hat	registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:1a4e4ddfdd6f353c67172dec6b6d5e3c07d3f67410d537066e2b0321b044698a_amd64 as a component of Red Hat Web Terminal 1.15	registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:1a4e4ddfdd6f353c67172dec6b6d5e3c07d3f67410d537066e2b0321b044698a_amd64, *, registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:1a4e4ddfdd6f353c67172dec6b6d5e3c07d3f67410d537066e2b0321b044698a_amd64
Red Hat	Red Hat Web Terminal
Red Hat	registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:a531c9a89a0ddf261241c353de8866f6609b535e3dbaf05bf3ff410234398d7b_amd64 as a component of Red Hat Web Terminal 1.15	, , *
Red Hat	registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:4c3d303dca13ac5383927d0c428b9418a6009e2b8ee686b1f246c94b783e02b0_amd64 as a component of Red Hat Web Terminal 1.15	*, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:4c3d303dca13ac5383927d0c428b9418a6009e2b8ee686b1f246c94b783e02b0_amd64, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:4c3d303dca13ac5383927d0c428b9418a6009e2b8ee686b1f246c94b783e02b0_amd64
golang	go
golang	Go
Red Hat	Web Terminal
Red Hat	Web Terminal Operator
Red Hat	registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:4c3d303dca13ac5383927d0c428b9418a6009e2b8ee686b1f246c94b783e02b0_amd64 as a component of Red Hat Web Terminal 1.15	registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:4c3d303dca13ac5383927d0c428b9418a6009e2b8ee686b1f246c94b783e02b0_amd64, *, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:4c3d303dca13ac5383927d0c428b9418a6009e2b8ee686b1f246c94b783e02b0_amd64
golang	net/url
Red Hat	registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:69bbe9115e6a686bf3efba029c4d27fe87a003745536db3a80abe7466398206d_amd64 as a component of Red Hat Web Terminal 1.15	registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:69bbe9115e6a686bf3efba029c4d27fe87a003745536db3a80abe7466398206d_amd64, registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:69bbe9115e6a686bf3efba029c4d27fe87a003745536db3a80abe7466398206d_amd64, registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:69bbe9115e6a686bf3efba029c4d27fe87a003745536db3a80abe7466398206d_amd64
Red Hat	registry.redhat.io/web-terminal/web-terminal-exec-rhel9
Red Hat	Red Hat Web Terminal Operator
Red Hat	registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:1a4e4ddfdd6f353c67172dec6b6d5e3c07d3f67410d537066e2b0321b044698a_amd64 as a component of Red Hat Web Terminal 1.15
Red Hat	registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:1a4e4ddfdd6f353c67172dec6b6d5e3c07d3f67410d537066e2b0321b044698a_amd64

…and 2 more

Timeline

Apr 14, 2026 CVE Published
Aug 30, 2026 CVE Updated
Aug 30, 2026 Distribution Patch
Aug 30, 2026 Distribution Patch
Aug 30, 2026 Security Advisory
Aug 30, 2026 Security Advisory
Aug 30, 2026 Security Advisory
Aug 30, 2026 Security Advisory
Aug 30, 2026 Security Advisory
Aug 30, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:8167 advisory
https://access.redhat.com/security/cve/CVE-2025-61726 advisory
https://access.redhat.com/security/cve/CVE-2025-61729 advisory
https://access.redhat.com/security/cve/CVE-2025-68121 advisory
https://access.redhat.com/security/cve/CVE-2026-25679 advisory
https://access.redhat.com/security/cve/CVE-2026-27137 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://redhat.atlassian.net/browse/WTO-368 advisory
https://redhat.atlassian.net/browse/WTO-373 advisory
https://redhat.atlassian.net/browse/WTO-377 advisory
https://redhat.atlassian.net/browse/WTO-383 advisory
https://redhat.atlassian.net/browse/WTO-390 advisory
https://redhat.atlassian.net/browse/WTO-393 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8167.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2434432 issue
https://www.cve.org/CVERecord?id=CVE-2025-61726 advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61726 advisory
https://go.dev/cl/736712 advisory
https://go.dev/issue/77101 advisory
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc advisory

…and 28 more

Open in Interactive Console →