VDB
RHSA-2026:67936
RHSA-2026:67936
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9@sha256:852c92ef851ceaa29bcf983636c806090570ae12f4e4076cddbf726342cc7177_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-olm-rhel9-operator@sha256:2ae2155e9dc00b7bc7b2e909684e1ed9f9c48b979a36497d2c5e53574df20683_s390x as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:76f1552e228d79ad0d4dfac7b769a54f2d8ed752634c6bba70cf079ec891b035_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-ibm-vpc-block-csi-driver-rhel9@sha256:3e0b146bdbb56e1203e58193d1fd7f108ca232a74060d78f56f3a3751edc52ff_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:e56a666945b9720c57bf4667ff60dabd530a5bbdc75baeadf1cf47b8bd76b4fd_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-baremetal-operator-rhel9@sha256:f69fba54f4b618ef20ae2bdc406cbc693d423da7e6d7d3e01af92df94dd32ae6_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-hyperkube-rhel9@sha256:4a7c4b2770d6c43bc0612ddfe4c9ed4aa9129228afd2247f968001595c9e6d78_s390x as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-rhel9-operator@sha256:d43717f8313248bdab2291aca38a94944ff681db85e8456a6a499c5cc2978f94_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:f7a7f10dab594e0403ed50efa059a105626148fab37bfb7db6715d60ff28bc20_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:aff1b069bfdc7c640ef74174186d54dbfd957bcfb995b24426e7855eefc9d16a_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator@sha256:fcafa60cdfc61ca74b96d89845e4c234c4ba7d053016df7c72c44e2a01e02e13_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-thanos-rhel9@sha256:8dc58caeca5ea4e4e5f273eb83e9c0615953447c1533101875b50d26748d3cab_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9@sha256:6117c6858f625db998620d0614660f987bf1a6ed824919b8c272bc533efe8ed9_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-monitoring-rhel9-operator@sha256:e3e1e0f8df5bad0861853d15de71ebe0970c26aecd0167b90a29e4696df5bc1d_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:dfffabdc8a0f04254ee1eca2c889895aaab8ec487aa954f8b69d6b37b355d81d_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9-operator@sha256:178e65655a18f99efdcb2e9abadca425a7ed4b97b9b1ce5c3052260c3f974240_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:8d9ae1cd162e52844ec8f39c524db42228bf36facb77b7a68baa7b7ee94414c4_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:99d1bef2fcff1fa090d6b733e7f3aa9216a6e2b1f7917ef016281871e2331319_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:553ce1f95c82803481c05a1d5d5c25944fc1d723ae6abf26db5476c4fe74bd66_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator@sha256:643d6af18bd81bbf7a59679da98e4184628a279e65a71aea18f09ba327152911_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, * |
…and 633 more
Timeline
- Sep 24, 2026 CVE Published
- Oct 18, 2026 CVE Updated
- Oct 18, 2026 Distribution Patch
- Oct 18, 2026 Distribution Patch
- Oct 18, 2026 Security Advisory
- Oct 18, 2026 Security Advisory
- Oct 18, 2026 Security Advisory
- Oct 18, 2026 Security Advisory
- Oct 18, 2026 Security Advisory
- Oct 18, 2026 Security Advisory
- Oct 18, 2026 Security Advisory
- Oct 18, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:67936 advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-33818 advisory
- https://access.redhat.com/security/cve/CVE-2026-42504 advisory
- https://access.redhat.com/security/cve/CVE-2026-43003 advisory
- https://access.redhat.com/security/cve/CVE-2026-44918 advisory
- https://access.redhat.com/security/cve/CVE-2026-44990 advisory
- https://access.redhat.com/security/cve/CVE-2026-45623 advisory
- https://access.redhat.com/security/cve/CVE-2026-48801 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-56858 advisory
- https://access.redhat.com/security/cve/CVE-2026-56859 advisory
- https://access.redhat.com/security/cve/CVE-2026-56860 advisory
- https://access.redhat.com/security/cve/CVE-2026-56862 advisory
- https://access.redhat.com/security/cve/CVE-2026-66138 advisory
- https://access.redhat.com/security/cve/CVE-2026-69153 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67936.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
…and 94 more