VDB

RHSA-2026%3A9698

RHSA-2026%3A9698 PUBLISHED CVSS 7.5 HIGH

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatregistry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:a7940ced8ebfc480ff4e3daecd6362ec60bc94e7bcfa7d80275f2a3f97eb6f3e_amd64 as a component of Red Hat OpenShift GitOps 1.19*, *, *
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:38a8d2575efdebc83519349b0bba68f72abca3c4bff4731cee24b3983252ad13_arm64 as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:38a8d2575efdebc83519349b0bba68f72abca3c4bff4731cee24b3983252ad13_arm64, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:38a8d2575efdebc83519349b0bba68f72abca3c4bff4731cee24b3983252ad13_arm64
Red Hatregistry.redhat.io/openshift-gitops-1/gitops-rhel8@sha256:c611a1baeca063e4cc10653601f9223f84f81cfec211a01c32b8f205b6eb3ad9_arm64 as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/gitops-rhel8@sha256:c611a1baeca063e4cc10653601f9223f84f81cfec211a01c32b8f205b6eb3ad9_arm64, registry.redhat.io/openshift-gitops-1/gitops-rhel8@sha256:c611a1baeca063e4cc10653601f9223f84f81cfec211a01c32b8f205b6eb3ad9_arm64
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:38a8d2575efdebc83519349b0bba68f72abca3c4bff4731cee24b3983252ad13_arm64 as a component of Red Hat OpenShift GitOps 1.19*, *, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:38a8d2575efdebc83519349b0bba68f72abca3c4bff4731cee24b3983252ad13_arm64
Red Hatregistry.redhat.io/openshift-gitops-1/must-gather-rhel8@sha256:c471def38bdc188df4fd701792dabc3636bb7fb0476a004c45e8ae0a5b95babc_ppc64le as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/must-gather-rhel8@sha256:c471def38bdc188df4fd701792dabc3636bb7fb0476a004c45e8ae0a5b95babc_ppc64le, registry.redhat.io/openshift-gitops-1/must-gather-rhel8@sha256:c471def38bdc188df4fd701792dabc3636bb7fb0476a004c45e8ae0a5b95babc_ppc64le
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:c1f0cff25f290e7e9834372bc5bb3e63aad754ae3fe13a11c502eec3f5c8a8b9_arm64 as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:c1f0cff25f290e7e9834372bc5bb3e63aad754ae3fe13a11c502eec3f5c8a8b9_arm64, *
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:04673bdebda425bad1c73fa2c99e89016b90adde92ab5b18854a213099e16f99_ppc64le as a component of Red Hat OpenShift GitOps 1.19*, registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:04673bdebda425bad1c73fa2c99e89016b90adde92ab5b18854a213099e16f99_ppc64le, registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:04673bdebda425bad1c73fa2c99e89016b90adde92ab5b18854a213099e16f99_ppc64le
Red Hatregistry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:13171c90460b93c0b375b1a2d3fb82340c29cfcab7e512f2117812d453a0f235_ppc64le as a component of Red Hat OpenShift GitOps 1.19*, registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:13171c90460b93c0b375b1a2d3fb82340c29cfcab7e512f2117812d453a0f235_ppc64le, *
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:98a3e4019e9f68050237f34cb7a89c125c317973158184fba55ace5f772cd76a_amd64 as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:98a3e4019e9f68050237f34cb7a89c125c317973158184fba55ace5f772cd76a_amd64, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:98a3e4019e9f68050237f34cb7a89c125c317973158184fba55ace5f772cd76a_amd64
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:228a16b400172e8b31a8f727d700a50a3aa9a2347527be18495a12370e93ae2b_s390x as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:228a16b400172e8b31a8f727d700a50a3aa9a2347527be18495a12370e93ae2b_s390x, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:228a16b400172e8b31a8f727d700a50a3aa9a2347527be18495a12370e93ae2b_s390x, *
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:df066f65a2ebc5a6910e8ff41bfab5c310b3a5739ffdb60501f9941d9961213f_arm64 as a component of Red Hat OpenShift GitOps 1.19*, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:df066f65a2ebc5a6910e8ff41bfab5c310b3a5739ffdb60501f9941d9961213f_arm64
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:943616dc45c24ce59a6962443814dce9f4076d5bd25c041830da5e9ada2dbf1b_ppc64le as a component of Red Hat OpenShift GitOps 1.19*, registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:943616dc45c24ce59a6962443814dce9f4076d5bd25c041830da5e9ada2dbf1b_ppc64le
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:c1f0cff25f290e7e9834372bc5bb3e63aad754ae3fe13a11c502eec3f5c8a8b9_arm64 as a component of Red Hat OpenShift GitOps 1.19*, registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:c1f0cff25f290e7e9834372bc5bb3e63aad754ae3fe13a11c502eec3f5c8a8b9_arm64, registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:c1f0cff25f290e7e9834372bc5bb3e63aad754ae3fe13a11c502eec3f5c8a8b9_arm64
Red Hatregistry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:a7940ced8ebfc480ff4e3daecd6362ec60bc94e7bcfa7d80275f2a3f97eb6f3e_amd64 as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:a7940ced8ebfc480ff4e3daecd6362ec60bc94e7bcfa7d80275f2a3f97eb6f3e_amd64, registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:a7940ced8ebfc480ff4e3daecd6362ec60bc94e7bcfa7d80275f2a3f97eb6f3e_amd64
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:3aca316cc39a16b92ca20177841b5d1643e26132f16b9b16dc1b8171587e21ed_s390x as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:3aca316cc39a16b92ca20177841b5d1643e26132f16b9b16dc1b8171587e21ed_s390x, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:3aca316cc39a16b92ca20177841b5d1643e26132f16b9b16dc1b8171587e21ed_s390x
Red Hatregistry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:9fce35bd136512e2b6bd09e6c82c73800c7b35e101578553ac26906c1982cbe1_ppc64le as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:9fce35bd136512e2b6bd09e6c82c73800c7b35e101578553ac26906c1982cbe1_ppc64le, registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:9fce35bd136512e2b6bd09e6c82c73800c7b35e101578553ac26906c1982cbe1_ppc64le
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:6b755ab049dfa8a5f89dbde3bed00275b9ff807b338b2a7ecdaefeaed83b0bbc_amd64 as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:6b755ab049dfa8a5f89dbde3bed00275b9ff807b338b2a7ecdaefeaed83b0bbc_amd64, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:6b755ab049dfa8a5f89dbde3bed00275b9ff807b338b2a7ecdaefeaed83b0bbc_amd64
Red Hatregistry.redhat.io/openshift-gitops-1/gitops-rhel8@sha256:8ee05240161a2451ccc93b2cf69bff63c4a86386d7170cdd1f13f44fb75d5a36_s390x as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/gitops-rhel8@sha256:8ee05240161a2451ccc93b2cf69bff63c4a86386d7170cdd1f13f44fb75d5a36_s390x, *, *
Red Hatregistry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:dff08eed24153cb98b9fdf25702c6edd88467516d3a750f915c2b8972a206b72_s390x as a component of Red Hat OpenShift GitOps 1.19registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:dff08eed24153cb98b9fdf25702c6edd88467516d3a750f915c2b8972a206b72_s390x, *
Red Hatregistry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:83e7e20877ca983a2f2cf64db0b9b8ac44b4979276f3d3a90cc971f04bf9affb_s390x as a component of Red Hat OpenShift GitOps 1.19*, registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:83e7e20877ca983a2f2cf64db0b9b8ac44b4979276f3d3a90cc971f04bf9affb_s390x

…and 72 more

Timeline

  • Apr 22, 2026 CVE Published
  • Apr 25, 2026 Distribution Patch
  • Apr 25, 2026 Distribution Patch
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • May 19, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›