RHSA-2026:61313: Important: rhc security update
Important: rhc security update
Other sources
rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management.Security Fix(es): crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rhcto a version that resolves this vulnerability.Fixed in 0.3.2-6.el10_0 - Upgrade
Upgrade
redhat/rhc-debuginfoto a version that resolves this vulnerability.Fixed in 0.3.2-6.el10_0 - Upgrade
Upgrade
redhat/rhc-debugsourceto a version that resolves this vulnerability.Fixed in 0.3.2-6.el10_0 - Upgrade
Upgrade
redhat/rhcto a version that resolves this vulnerability.Fixed in 0.3.2-6.el10_0.aa - Upgrade
Upgrade
redhat/rhc-debuginfoto a version that resolves this vulnerability.Fixed in 0.3.2-6.el10_0.aa - Upgrade
Upgrade
redhat/rhc-debugsourceto a version that resolves this vulnerability.Fixed in 0.3.2-6.el10_0.aa - Upgrade
Upgrade
net/golang: Go net packageto a version that resolves this vulnerability.Patch CVE-2026-33811 - Upgrade
Upgrade
crypto/x509/golang: Go crypto/x509to a version that resolves this vulnerability.Patch CVE-2026-33810
Event History
Frequently Asked Questions
Which systems should be prioritized for this update?
Systems running the rhc client tool or daemon on the listed Red Hat Enterprise Linux ARM 64, Power little endian, or IBM z Systems support channels should be prioritized, because rhc connects those systems to Red Hat hosted services for system and subscription management.
What security issues are addressed by this update?
The update addresses a Go crypto/x509 certificate-validation bypass caused by incorrect DNS constraint application (CVE-2026-33810) and a denial of service in Go's net package through a long CNAME response to LookupCNAME (CVE-2026-33811).
How can I determine whether a system is in scope?
Check whether the system has the rhc package installed, including its debuginfo or debugsource packages, and whether it is using one of the listed Red Hat Enterprise Linux ARM 64, Power little endian, or IBM z Systems support offerings.