VDB
RHSA-2026:77267
RHSA-2026:77267
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:74f4a91c358944f90519477fa9b041de610389f8de4846b2fe32eeec9f3fa9ab_s390x as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a4a4e5d4e90b9a2948f6824ea4333224e54201e5fce53594f4b5830c3b482083_s390x as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:3fa8812a9a7b8607bc5f57243cc7b3ec33757aed11d589a58af1fcbb6368113a_s390x as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:0266210cf63123aa717d77c49dcf3031981e52e245c980426de25e057ab20c9b_arm64 as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:7a07b27185e2a10056a4a7cf01ba111c07a055b39fa71af329c8e6afe0434f8e_amd64 as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:cb9d9154e0573fcd6344123c5f61a66adce4a15f5a1a74f51464a06edb985f3b_s390x as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:50f202ab12bd2d85e36a06c93f97a39056208ec721a75e47118ad93b8e0638d0_amd64 as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-promoter-rhel9@sha256:4cec07765db3f48acc4ec055148f605d1f9fbbcc340b437ff125cf1fab0fb4a5_amd64 as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:b641491d57a12089873cf5a0339c023ff8ad3abf4547dfa8f815d4839b68626f_arm64 as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-4-18-rhel9@sha256:8b009d5f0e6bfe893ce0f94231fa686f88b2a3b3184c01f6e8cf8caaea28537c_ppc64le as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-4-18-rhel9@sha256:0bd6eac45f81bd48a9ff92348466fce53b3c1b1fc2d7dd1bc7f986edbbb75d63_amd64 as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:07b8f811de4c482330c5bc29f95f095cdfc5660df116ce5ba893cb54fe34f1ba_ppc64le as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:5f8647153bdae59206f91802f06f89c51ef516c6ec5a7766b0437119d32b5d78_ppc64le as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-promoter-extension-rhel9@sha256:bacbd05bdb3ac2111be9c91fce655d40f82fad8a95d4a5917397db8b35fa7603_amd64 as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-promoter-extension-rhel9@sha256:2d59876119954e6870993a09727b5290dc1b66cbe54062babb44ea8678a854ea_s390x as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-promoter-rhel9@sha256:f3a4e66107a01f4788841e5222be599fc9bf1f4f45216c34ac3ff2feb9890f36_ppc64le as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:6f6244ed1c0322231286c5c17a6f0b4dc1a87fd2183c6eea55a3a6009381cf6a_arm64 as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:373acc13d0973ccd162df093b997651d756268cdc5403afd3dd1956646ff1330_amd64 as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:6e0c0ac149bcd8eabbc425449cf78e884186bad5129448c3c5f697c7f1417acb_s390x as a component of Red Hat OpenShift GitOps 1.22 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:09265441aaf600fbe599c61681ffe7d886740c7e1231244d33bfe3644d57012c_ppc64le as a component of Red Hat OpenShift GitOps 1.22 | * |
…and 33 more
Timeline
- Oct 7, 2026 CVE Published
- Nov 1, 2026 CVE Updated
- Nov 1, 2026 Distribution Patch
- Nov 1, 2026 Distribution Patch
- Nov 1, 2026 Security Advisory
- Nov 1, 2026 Security Advisory
- Nov 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:77267 advisory
- https://access.redhat.com/security/cve/CVE-2026-33818 advisory
- https://access.redhat.com/security/cve/CVE-2026-77459 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.22/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77267.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33818 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33818 advisory
- https://go.dev/cl/814980 advisory
- https://go.dev/issue/80405 advisory
- https://groups.google.com/g/golang-announce/c/94pEornpRlI advisory
- https://pkg.go.dev/vuln/GO-2026-5972 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2548643 issue
- https://www.cve.org/CVERecord?id=CVE-2026-77459 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-77459 advisory
- https://github.com/argoproj/argo-cd/commit/d5dd7019e advisory
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp advisory