VDB

RHSA-2026:75908

RHSA-2026:75908 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatregistry.redhat.io/container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:3c5672450cbf11254024784fc8521ea3ffa787a6c9564f235e86f54afde4e00c_amd64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/kubesecondarydns-rhel9@sha256:9fdbc96216faad93f4c73ea8fab96d916d957fae36fd01d9c3f3170120983402_arm64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/bridge-marker-rhel9@sha256:afb6c5609cdf6f1e338065e378cd57559daa17f00885dffc77856974590fd15b_arm64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:ac19c3ac63e53a9b005b70cd8947eb8cd3c83ccff83c393d08eb3abaca338e1e_arm64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/multus-dynamic-networks-rhel9@sha256:20c99e53550bc1db8896bdaa3c6a9bec6733e559a53056da957a03c44a2e5019_arm64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/kubesecondarydns-rhel9@sha256:07ec279cd29ed840b508b3724d3e5af44039d99f2f57cec0a5148095f3a9285e_amd64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:5cdf5745df188431e493890e543c6899dda57bea5235dd83307c805d0ee5dcd4_arm64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/ovs-cni-plugin-rhel9@sha256:428993d7a46e0f5eae74bfa1513b6739dfba84e756a689689b0fa9b1c9772803_amd64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/multus-dynamic-networks-rhel9@sha256:6a6dfd6608d170892cff8325f2b279aff76835ce780039660c3cc87b39353ed2_amd64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/kubemacpool-rhel9@sha256:e208193093a30055b49f1dd161194b4af6ebe94bd2bbb326e57d295b4111ff59_amd64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/bridge-marker-rhel9@sha256:e71b03447e16c18ad63a7fa27001764e39037b0a10507ec67bd123c9bb690559_amd64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/kubemacpool-rhel9@sha256:580fa5387308c4362fde177ccf07609b35f6f61fbc686ca751560960edbee848_arm64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/ovs-cni-plugin-rhel9@sha256:0261e92f4a5bbd8ac0a525111a92979df356f01b7b52bba1f3c01be5b3f59c7e_arm64 as a component of Red Hat Container Native Virtualization 4.16*
Red Hatregistry.redhat.io/container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:655d22afd39a5fac09199f64b365500cd6d1d125893b9e9aa832270354138412_amd64 as a component of Red Hat Container Native Virtualization 4.16*

Timeline

  • Oct 5, 2026 CVE Published
  • Oct 15, 2026 CVE Updated
  • Oct 15, 2026 Distribution Patch
  • Oct 15, 2026 Distribution Patch
  • Oct 15, 2026 Security Advisory
  • Oct 15, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›