VDB
RHSA-2026:49600
RHSA-2026:49600
PUBLISHED
CVSS 7.800000190734863 HIGH
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
Risk Scores
CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhc-debugsource-1:0.2.2-1.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-1:0.2.2-1.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-debuginfo-1:0.2.2-1.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-debugsource-1:0.2.2-1.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-1:0.2.2-1.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-debuginfo-1:0.2.2-1.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-debuginfo-1:0.2.2-1.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-debugsource-1:0.2.2-1.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-1:0.2.2-1.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-1:0.2.2-1.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-debugsource-1:0.2.2-1.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-1:0.2.2-1.el9_2.3.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
| Red Hat | rhc-debuginfo-1:0.2.2-1.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 0.2.2-1.el9, 0.2.2-1.el9, 0.2.2-1.el9 |
Timeline
- Aug 3, 2026 CVE Published
- Sep 12, 2026 CVE Updated
- Sep 12, 2026 Distribution Patch
- Sep 12, 2026 Distribution Patch
- Sep 12, 2026 Security Advisory
- Sep 12, 2026 Security Advisory
- Sep 12, 2026 Security Advisory
- Sep 12, 2026 Security Advisory
- Sep 12, 2026 Security Advisory
- Sep 12, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:49600 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2437111 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456333 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456336 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456338 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456339 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49600.json advisory
- https://access.redhat.com/security/cve/CVE-2025-68121 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-68121 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-68121 advisory
- https://go.dev/cl/737700 advisory
- https://go.dev/issue/77217 advisory
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk advisory
- https://pkg.go.dev/vuln/GO-2026-4337 advisory
- https://access.redhat.com/security/cve/CVE-2026-32280 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-32280 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-32280 advisory
- https://go.dev/cl/758320 advisory
- https://go.dev/issue/78282 advisory
…and 20 more