RHSA-2026:95206: Updated Red Hat OpenStack Platform 16.2 director Operator container images
Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.The Red Hat OpenStack Platform (RHOSP) director Operator adds the ability to install and run a RHOSP cloud within OpenShift Container Platform (OCP).Security Fixes: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
Other sources
Updated Red Hat OpenStack Platform 16.2 director Operator container images
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which environments are in scope for this advisory?
The advisory applies to Red Hat OpenStack Platform 16.2 director Operator container images. The director Operator is used to install and run a Red Hat OpenStack Platform cloud within OpenShift Container Platform.
What kinds of issues are addressed by the updated images?
The listed fixes include Go vulnerabilities that could enable man-in-the-middle attacks, denial of service, and cross-site scripting. Affected Go components include crypto/x509, crypto/tls, net, encoding/asn1, MIME handling, net/http, html/template, and XML decoding.
What should be updated?
Update the Red Hat OpenStack Platform 16.2 director Operator container images referenced by RHSA-2026:95206. The provided data does not specify individual image versions or update commands.
When was this advisory published?
RHSA-2026:95206 was published and modified on 2026-11-04.