VDB
RHSA-2026:54556
RHSA-2026:54556
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:0d6c4d402b810176cf86abcb33345c1f77da7dafcb232c958462dfd0ceae30b5_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:92b39d71994c9581ced53d63c336acd593f1ae98c1a7be7f3d9a5f94f9264220_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9@sha256:a86870f9b97a3258a83b1137b814e402f56a90326e70bfbfe92c6aadc26212d1_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9@sha256:0b3d4a70a2425a4efcaaf921f3cd259cdffa37dd651ef22317f86d462c1bd9d3_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9@sha256:6166c0d863161b0918e4d8ae7ef089645e05d08623b00ba80ff9a805f87e5b1d_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-egress-router-rhel9@sha256:fd4c291e728d446607710d8bcb9074e4ba79c6f09e86b544cd4e52c1e5354897_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:eb86896a2438f37a31c365e1a794b53cea0b2dfbf6f9e8ff9fd6f6bb95910b3a_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-cni-rhel9@sha256:a5643f001f5d4c772307c9066003a010fe77ef888cc762ec074a04046c0d85ac_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:e2046c5c4cdb3b93102b357c186833d519d3cbfd0d90c38ea54a05518e0892ef_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:0eb9b5d105f10e76d857f9aca8e21c618290cd4d5af2ea01ed5dedd8059e21d8_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9-operator@sha256:c3afe2c62ba552d82c73fbd9ef0c6288f5d54b30dbf2fe70e0e20b8a611e28a2_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:f3c4590f25db33c0121140003c4eea7a0a2e06de04302eac8c69084c80f2f731_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:161f4e109b06594d1c191d2bb7b4367b5c508b1b4a7333efdf5c986248aeb2bb_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:2a2fcf454d3cd38870f566adf0fce05c819512df993c0c72159cd9cd9b524004_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:1940be22710d4a119c42278bd052573a90b995014f79073ff21bb5afbf2c6137_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:90b220d29886c41e5eefaef21e589657b519beb7b8662f569acca7ec53fa2a97_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:2c5127ffa86fbb4b3b6b8085557906a5b5d8aa48780a0f17e1eb9ba76fdf7fcd_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-egress-dns-proxy-rhel9@sha256:4b47e68f62da63b93a3e3679e6341819f67a6062477591b62149ad6cd57540e6_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:8bf3ca303c0efe5d14369c0c950edbc6e8d3cd1dc6cc0cd587905c6161678ed6_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:38451a4e485dbf6e2c249af510df82f290ddaf9bd1abea4298eccaa597ca8ac9_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
…and 165 more
Timeline
- Aug 19, 2026 CVE Published
- Aug 21, 2026 CVE Updated
- Aug 21, 2026 Distribution Patch
- Aug 21, 2026 Distribution Patch
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54556 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54556.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33811 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33811 advisory
- https://go.dev/cl/767860 advisory
- https://go.dev/issue/78803 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
- https://pkg.go.dev/vuln/GO-2026-4981 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480678 issue
- https://www.cve.org/CVERecord?id=CVE-2026-46597 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46597 advisory
- https://go.dev/cl/781620 advisory
- https://go.dev/issue/79561 advisory
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI advisory
- https://pkg.go.dev/vuln/GO-2026-5013 advisory
…and 8 more