RHSA-2026:98610: Important: gvisor-tap-vsock security update

Q: Which installed components should be included when assessing exposure to this update?

Assess systems with red Hat gvisor-tap-vsock installed, including the gvisor-tap-vsock-gvforwarder component. The advisory also lists debuginfo and debugsource packages, but does not provide package versions or configuration-specific exposure details.

Q: What types of attacks are addressed by this update?

The fixes address multiple denial-of-service conditions involving ASN.1 unmarshalling, unencrypted HTTP/2, TLS KeyUpdate messages, HTTP Range headers, ECH extension references, and multipart form parsing. It also addresses a man-in-the-middle risk involving untrusted intermediate certificates in crypto/x509.

Q: Can this advisory determine whether a particular deployment is currently exploitable?

No. The provided information does not specify affected versions, vulnerable default configurations, required network exposure, or detection indicators; it only identifies the affected product packages and the included CVEs.

Published Nov 11, 2026

Updated

A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.Security Fix(es): encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

20 affected componentsFixes available

redhat/gvisor-tap-vsock<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-debuginfo<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-debugsource<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-gvforwarder<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-gvforwarder-debuginfo<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-debuginfo<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-debugsource<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-gvforwarder<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-gvforwarder-debuginfo<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-debuginfo<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-debugsource<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-gvforwarder<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock-gvforwarder-debuginfo<0.8.7-2.el10_3

0.8.7-2.el10_3

redhat/gvisor-tap-vsock<0.8.7-2.el10_3.aa

0.8.7-2.el10_3.aa

redhat/gvisor-tap-vsock-debuginfo<0.8.7-2.el10_3.aa

0.8.7-2.el10_3.aa

redhat/gvisor-tap-vsock-debugsource<0.8.7-2.el10_3.aa

0.8.7-2.el10_3.aa

redhat/gvisor-tap-vsock-gvforwarder<0.8.7-2.el10_3.aa

0.8.7-2.el10_3.aa

redhat/gvisor-tap-vsock-gvforwarder-debuginfo<0.8.7-2.el10_3.aa

0.8.7-2.el10_3.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/gvisor-tap-vsock to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3
Upgrade
Upgrade redhat/gvisor-tap-vsock-debuginfo to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3
Upgrade
Upgrade redhat/gvisor-tap-vsock-debugsource to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3
Upgrade
Upgrade redhat/gvisor-tap-vsock-gvforwarder to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3
Upgrade
Upgrade redhat/gvisor-tap-vsock-gvforwarder-debuginfo to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3
Upgrade
Upgrade redhat/gvisor-tap-vsock to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3.aa
Upgrade
Upgrade redhat/gvisor-tap-vsock-debuginfo to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3.aa
Upgrade
Upgrade redhat/gvisor-tap-vsock-debugsource to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3.aa
Upgrade
Upgrade redhat/gvisor-tap-vsock-gvforwarder to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3.aa
Upgrade
Upgrade redhat/gvisor-tap-vsock-gvforwarder-debuginfo to a version that resolves this vulnerability.
Fixed in 0.8.7-2.el10_3.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which installed components should be included when assessing exposure to this update?

Assess systems with red Hat gvisor-tap-vsock installed, including the gvisor-tap-vsock-gvforwarder component. The advisory also lists debuginfo and debugsource packages, but does not provide package versions or configuration-specific exposure details.

What types of attacks are addressed by this update?

The fixes address multiple denial-of-service conditions involving ASN.1 unmarshalling, unencrypted HTTP/2, TLS KeyUpdate messages, HTTP Range headers, ECH extension references, and multipart form parsing. It also addresses a man-in-the-middle risk involving untrusted intermediate certificates in crypto/x509.

Can this advisory determine whether a particular deployment is currently exploitable?

No. The provided information does not specify affected versions, vulnerable default configurations, required network exposure, or detection indicators; it only identifies the affected product packages and the included CVEs.

RHSA-2026:98610: Important: gvisor-tap-vsock security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installed components should be included when assessing exposure to this update?

What types of attacks are addressed by this update?

Can this advisory determine whether a particular deployment is currently exploitable?

Company

Resources

Contact

Frequently Asked Questions

Which installed components should be included when assessing exposure to this update?

What types of attacks are addressed by this update?

Can this advisory determine whether a particular deployment is currently exploitable?