VDB
RHSA-2026:77273
RHSA-2026:77273
PUBLISHED
CVSS 6.800000190734863 MEDIUM
Record from redhat · Published October 7, 2026
A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.
Risk scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0c69677fb97d585cd80f800077441fa0f5d17bd4f51a32362eff4c2cdbfbd56d_s390x as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:03697a7435a7ecb988faad6663771633b765f64320254fc0c32abb9ede750846_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:dc8e1cab87a08c403f7bd7b4b306652e4accb5c9f5706ccb626a1d942f16c874_s390x as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:b9174bc56ec02e7a71f9807e56d85c887fad782b153f17daf37f10851f4833bb_ppc64le as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:9219504aef129b62971960248aeab972ed8df13073b8437b11ea09f08caecbe1_s390x as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:6f3f275f729b1c39dce4d8d4fe5b1e95d7c0cdab1f51282f5cbe890c3c909452_s390x as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:4929d21e9a682ecef763297f7e1263157000a38f79b1939a641c9e80948247e6_ppc64le as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:33dbb17bfa2436b09fe2a974fb5d84ac751a8d15939ccb8bd1ebe744a9be5e0a_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:af6ce25027d048b087fba568c85a0ba17a5635b272e2215aeac8f14c1ecda802_s390x as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:6e29d4c3f465ca793d7307ec91f43e56ff8db1efa71a16fd4f0efb7791a30a49_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:a36c50caa37b406916dd278376eb1d35229c087beb3b82dfd511dfb41076164d_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:5b68b3c0bae4429238f723910f48ead084ccf40b41158676c3a8874ae65b35ca_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b6e1abe3c485cdbd911830691a5eae34741093233ff65a446f811a875a963b0e_arm64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:ab47286abdc45bf45b8bfec0ecd4b3d63c9bee9fbd43d48fc5d3cb43876b00de_ppc64le as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:7ec5d4c543bbb0f42aae03437eb3d27779ce90cb9e5c58180e4b21634486f9bf_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b63d4916eb9f4ff2b0381c8a82e8c44ffc0050724747f152fa7560b0925f2b47_ppc64le as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:5e2815998b123ef256df13c8256e9a68eb174ad31d12728a3366f73212030f6d_s390x as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:f2e8cad4de081b8cb9db1031378c42279afc9dcba555287964595b54542c01c2_arm64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:18473fe92565afb2c13427a1119e3333f885e12188bb13ae7ca52e922033b6f6_arm64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:5580f88c8f896f9a94bada7d2053eb4216be0f8b060d08eacdbb0ab49e859a07_arm64 as a component of Red Hat OpenShift GitOps 1.20 | * |
…and 21 more
Timeline
- Oct 7, 2026 CVE Published
- Nov 1, 2026 CVE Updated
- Nov 1, 2026 Distribution Patch (2 in total, the first dated here)
- Nov 1, 2026 Security Advisory (10 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2026:77273
vulnetix vdb fixes RHSA-2026:77273Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A77273/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/errata/RHSA-2026:77273 advisory
- https://access.redhat.com/security/cve/CVE-2026-33818 advisory
- https://access.redhat.com/security/cve/CVE-2026-50162 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-56853 advisory
- https://access.redhat.com/security/cve/CVE-2026-56854 advisory
- https://access.redhat.com/security/cve/CVE-2026-56859 advisory
- https://access.redhat.com/security/cve/CVE-2026-56860 advisory
- https://access.redhat.com/security/cve/CVE-2026-56862 advisory
- https://access.redhat.com/security/cve/CVE-2026-77459 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.20/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77273.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33818 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33818 advisory
- https://go.dev/cl/814980 advisory
- https://go.dev/issue/80405 advisory
- https://groups.google.com/g/golang-announce/c/94pEornpRlI advisory
- https://pkg.go.dev/vuln/GO-2026-5972 advisory
…and 45 more