VDB
RHSA-2026:52946
RHSA-2026:52946
PUBLISHED
CVSS 9.899999618530273 CRITICAL
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
Risk Scores
CVSS 3.1
9.899999618530273
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:629c601f75821fc79cc905ddeef2301c20f89932a5bc4b2d71b86deb5da75b63_arm64 as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f1f58a76e9278fbe234cf6ca99383a96fabd716186d9f1908080b4532ce3c7fb_s390x as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca8bf1d0e387476163e21d18dd6ab195f0348ef498fe61b058fb284d62b131cb_s390x as a component of Multicluster Global Hub 1.8.1 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:0cd013a1552dae6134812eb39c9ddf46b5a5b16c8f433fdc95f16f8765a72a18_arm64 as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:eac0133e4c8130d6ee373faa034e920070db1515212bfd0c9a6d559cd31a6647_amd64 as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:351c748dd43ee596b8565f4742569fec5dd6c41f6c0646f4b58ab1ee4bc8b603_amd64 as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5292916fe3b9e955345d049a003fda95983ef54495f9af1b16d1ed7587266249_s390x as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:660024abdf32887c978d5e19b7a968c0d04d94f50937aa948d0c8b2cfd74e548_ppc64le as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca8bf1d0e387476163e21d18dd6ab195f0348ef498fe61b058fb284d62b131cb_s390x as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:068e16c4575f853f8a292bc3f34d50ee0fdb76e410d5e6a273399d5e7533ec31_ppc64le as a component of Multicluster Global Hub 1.8.1 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0f4674f643df1e8cfe5b11d9c992e85b32dc915ab951c080b7456acd34069fdd_arm64 as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:69229a78e4a5f37c5b3ecce7b8056fd43ab7aa3ec581a0b180e38de6866253c2_arm64 as a component of Multicluster Global Hub 1.8.1 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:09f57ff7ccf26c7034221ac57936aa8ae6e6ef1b6406d0050949917ca68ce146_s390x as a component of Multicluster Global Hub 1.8.1 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:eac0133e4c8130d6ee373faa034e920070db1515212bfd0c9a6d559cd31a6647_amd64 as a component of Multicluster Global Hub 1.8.1 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:9fa9b4a4984fa2c8057ec7375a613a302bf6a99ec5c6059dfb43e35fb3a29ae8_amd64 as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:737736d10e925c7f8de9560552735aa0bc4404470a3a4fa5e60b63d383b28037_amd64 as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:0d1f2503b10bda1c3d075a57c7ba23759dd42101edda14edf59a4c05da0b095f_ppc64le as a component of Multicluster Global Hub 1.8.1 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:b421850439207c883866768499822794db6c04a473f8fa80d553e3b35e595e33_arm64 as a component of Multicluster Global Hub 1.8.0 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:660024abdf32887c978d5e19b7a968c0d04d94f50937aa948d0c8b2cfd74e548_ppc64le as a component of Multicluster Global Hub 1.8.1 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:0cd013a1552dae6134812eb39c9ddf46b5a5b16c8f433fdc95f16f8765a72a18_arm64 as a component of Multicluster Global Hub 1.8.1 | *, * |
…and 23 more
Timeline
- Aug 10, 2026 CVE Published
- Sep 9, 2026 CVE Updated
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:52946 advisory
- https://access.redhat.com/security/cve/CVE-2026-27145 advisory
- https://access.redhat.com/security/cve/CVE-2026-33376 advisory
- https://access.redhat.com/security/cve/CVE-2026-33377 advisory
- https://access.redhat.com/security/cve/CVE-2026-53492 advisory
- https://access.redhat.com/security/cve/CVE-2026-55677 advisory
- https://access.redhat.com/security/cve/CVE-2026-55969 advisory
- https://access.redhat.com/security/cve/CVE-2026-66801 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52946.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484207 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27145 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27145 advisory
- https://go.dev/cl/783621 advisory
- https://go.dev/issue/79694 advisory
- https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw advisory
- https://pkg.go.dev/vuln/GO-2026-5037 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2477262 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33376 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33376 advisory
…and 22 more