RHSA-2026:98506: Important: rhc security update
rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management.Security Fix(es): net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rhcto a version that resolves this vulnerability.Fixed in 0.2.7-18.el9_9 - Upgrade
Upgrade
redhat/rhc-debuginfoto a version that resolves this vulnerability.Fixed in 0.2.7-18.el9_9 - Upgrade
Upgrade
redhat/rhc-debugsourceto a version that resolves this vulnerability.Fixed in 0.2.7-18.el9_9 - Upgrade
Upgrade
redhat/rhcto a version that resolves this vulnerability.Fixed in 0.2.7-18.el9_9.aa - Upgrade
Upgrade
redhat/rhc-debuginfoto a version that resolves this vulnerability.Fixed in 0.2.7-18.el9_9.aa - Upgrade
Upgrade
redhat/rhc-debugsourceto a version that resolves this vulnerability.Fixed in 0.2.7-18.el9_9.aa - Upgrade
Upgrade
redhat/rhc-develto a version that resolves this vulnerability.Fixed in 0.2.7-18.el9_9 - Upgrade
Upgrade
redhat/rhc-develto a version that resolves this vulnerability.Fixed in 0.2.7-18.el9_9.aa
Event History
Frequently Asked Questions
Which components are included in this update?
The update covers the rhc package and its debuginfo, debugsource, and devel packages.
What types of denial-of-service conditions are addressed?
The fixes address denial of service through crafted HTTP Range headers, multiple TLS ECH outer extension references, and excessive HTTP/2 SETTINGS frames.