VDB
RHSA-2026:54584
RHSA-2026:54584
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:85320606ea1de014a9776cc316c1a3fc0cfa3930a6b1db59f731eca9c3e4c659_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/pf-status-relay-rhel9@sha256:97d42ba2e546774b9e80b3022aacd57e1179a11d3ebd72075571d4970682b3ba_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:2973ae539c2d86077497b3e8d6703b1853c319b9449c206f2b805e832931b51d_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:dbeb4a80190c7f04c59009dc6adbf90d595071e77b7b95d9b5a10d04c710a61d_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:404346e4c190d4e1cf5c2b731d94d41720da13cc0d1f198a480e48ba04e7ee4d_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:556e4cd2048c8642fcf887bab0a9c3ec4c95b73b5589b401da9f83f3ccae4a1d_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9-operator@sha256:386bb17f53c4157678a9193531e97dc0dd19047c7c71f823f6b527cd1c69e86d_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9@sha256:7c3ca2efa943186618a4b76524d807fa8c38c66b2eab4ea2bc5fbc3cae3bd818_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:3c0a259bf3349df6bc986ed863ded3e2c4d45228e0cde41f9cb10a5a5af17356_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:3d857d2f09b251a2324976d36ddc3c1845520270d3a4f85718620e9ae76fe631_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-cni-rhel9@sha256:83557eaed443c23775579a5bd8fb431436948366a621377278fba4fbaf415b27_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:59036ec9784fa0e9761a63cdbc40a4d54d09dafb0999c60943fc491fa8c9db3f_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator@sha256:6a76d7e9b057b496041ced413f22ada0025e1876429b14bf211cc37cae61a2f7_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:d5e6c9f678b09a3e46c6613251ca8cf4025e8dcee72b3ede8dd84b1fa64d7a87_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9-operator@sha256:cd9305abc68dbcd12b0b5748fc57ea4c94dcede029b847efca74b17a5d5354d4_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:f9450bd84b878aa047a3bafe25f0304c9f4ce6efc658cfcdf26f3bf8ae43d755_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:6da6c7fa1f5470f43b1039d3b471a10de9a2ebe7d8455d534368fe52634b50c0_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:0433533c8d39110e37a99cca92fefe578f7a3e0498d9e7c3878ebc6b1ff3f5f9_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:c453bbda94e1367a60bf91a3865580da31706445f438f5968dad7289af29a18a_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9@sha256:d61bfe6bf48435e2c0faf04c7045e811695b3281069b4161fd23e017d95f1190_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
…and 157 more
Timeline
- Aug 18, 2026 CVE Published
- Aug 21, 2026 CVE Updated
- Aug 21, 2026 Distribution Patch
- Aug 21, 2026 Distribution Patch
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54584 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54584.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33811 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33811 advisory
- https://go.dev/cl/767860 advisory
- https://go.dev/issue/78803 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
- https://pkg.go.dev/vuln/GO-2026-4981 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480678 issue
- https://www.cve.org/CVERecord?id=CVE-2026-46597 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46597 advisory
- https://go.dev/cl/781620 advisory
- https://go.dev/issue/79561 advisory
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI advisory
- https://pkg.go.dev/vuln/GO-2026-5013 advisory
…and 8 more