VDB

RHSA-2026:75935

RHSA-2026:75935 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatregistry.redhat.io/container-native-virtualization/kubesecondarydns-rhel9@sha256:d0f6e5fcaed9794abbbfb91c889ea8f45478b46a873175e9e255dc323bce16ff_amd64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/ovs-cni-plugin-rhel9@sha256:377e4395c56d94135437c82cd0f684e23541db94e222b90274e22ee9760f0607_amd64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/kubemacpool-rhel9@sha256:ddd2310b68963d8b78b7514dddefd2c571adfbc57ecc250ce9aaea8d437f7c0a_amd64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:85a1242e97a40052cc0d70434ad025a74e28bdd6e584fa9de09bdedd1cfd6934_amd64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/bridge-marker-rhel9@sha256:8a782db30016efb00924be597e7ade5ac8e75143822a1c1f422ec0f4599d1485_amd64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/kubemacpool-rhel9@sha256:b1feed4872d6ccd8e9945b5e6d684054226ea3f55c96ca36f4bbee9d1c7cb26e_arm64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/kubesecondarydns-rhel9@sha256:47cf36992073733b94b796988d86ae8a74d8745d537477bd305a6d32fba7ad1c_arm64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/multus-dynamic-networks-rhel9@sha256:78491f8e1afa41b435d893e388e1f7f490a729b23ce3e957336d8423c434d95b_arm64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:bfca1ccf18af64ddd15a49b35a87f2c4bc7f6568350387507a6aba88c98d0111_arm64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/ovs-cni-plugin-rhel9@sha256:58c53b42094f98c908e70cc5799708af6e1259d0c3b0d70999b2148b8a2f0d35_arm64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:098f3bb59c902a99b44ae270c73d07030a1e18c4c8d7898e39fba86e7ad0a4d5_arm64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/multus-dynamic-networks-rhel9@sha256:0e2c968b4698001ec79cefd285a644cb68b10c836fc19aeb37a3c4541c05f89d_amd64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/bridge-marker-rhel9@sha256:ee9e02763cb47e0914bf9717dfdf3e6682a43de250fd86db29d1f8a51567e292_arm64 as a component of Red Hat Container Native Virtualization 4.14*
Red Hatregistry.redhat.io/container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:2c29af724103d1d7c2d8f161bddeaa4caee667d25bf0510ce236877b6441c8f3_amd64 as a component of Red Hat Container Native Virtualization 4.14*

Timeline

  • Oct 5, 2026 CVE Published
  • Oct 15, 2026 CVE Updated
  • Oct 15, 2026 Distribution Patch
  • Oct 15, 2026 Distribution Patch
  • Oct 15, 2026 Security Advisory
  • Oct 15, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›