RHSA-2026:99088: Important: containernetworking-plugins security update

Q: What kind of attack does this update address?

It addresses a denial-of-service issue in Go's net/http handling of crafted HTTP Range headers. An attacker would need to send specially crafted HTTP requests to an affected HTTP service.

Q: Which deployments should be prioritized for remediation?

Prioritize affected containernetworking-plugins installations on the listed Red Hat Enterprise Linux offerings where exposed services may process HTTP requests. The advisory identifies the issue as an Important security update.

Q: How can I determine whether my system is affected?

Check whether containernetworking-plugins or its related debuginfo/debugsource packages are installed on one of the listed Red Hat Enterprise Linux product streams, then compare the available update information with RHSA-2026:99088.

Published Nov 11, 2026

Updated

Important: containernetworking-plugins security update

Other sources

The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. Security Fix(es): net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat

Affected Software

24 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Update Support

Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions

Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Update Support

Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Update Support

Red Hat Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions

Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for IBM z Systems - 4 years of updates

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Update Support

redhat/containernetworking-plugins<1.9.0-5.el9_8

1.9.0-5.el9_8

redhat/containernetworking-plugins<1.9.0-5.el9_8

1.9.0-5.el9_8

redhat/containernetworking-plugins-debuginfo<1.9.0-5.el9_8

1.9.0-5.el9_8

redhat/containernetworking-plugins-debugsource<1.9.0-5.el9_8

1.9.0-5.el9_8

redhat/containernetworking-plugins-debuginfo<1.9.0-5.el9_8

1.9.0-5.el9_8

redhat/containernetworking-plugins-debugsource<1.9.0-5.el9_8

1.9.0-5.el9_8

redhat/containernetworking-plugins<1.9.0-5.el9_8

1.9.0-5.el9_8

redhat/containernetworking-plugins-debuginfo<1.9.0-5.el9_8

1.9.0-5.el9_8

redhat/containernetworking-plugins-debugsource<1.9.0-5.el9_8

1.9.0-5.el9_8

redhat/containernetworking-plugins<1.9.0-5.el9_8.aa

1.9.0-5.el9_8.aa

redhat/containernetworking-plugins-debuginfo<1.9.0-5.el9_8.aa

1.9.0-5.el9_8.aa

redhat/containernetworking-plugins-debugsource<1.9.0-5.el9_8.aa

1.9.0-5.el9_8.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/containernetworking-plugins to a version that resolves this vulnerability.
Fixed in 1.9.0-5.el9_8
Upgrade
Upgrade redhat/containernetworking-plugins-debuginfo to a version that resolves this vulnerability.
Fixed in 1.9.0-5.el9_8
Upgrade
Upgrade redhat/containernetworking-plugins-debugsource to a version that resolves this vulnerability.
Fixed in 1.9.0-5.el9_8
Upgrade
Upgrade redhat/containernetworking-plugins to a version that resolves this vulnerability.
Fixed in 1.9.0-5.el9_8.aa
Upgrade
Upgrade redhat/containernetworking-plugins-debuginfo to a version that resolves this vulnerability.
Fixed in 1.9.0-5.el9_8.aa
Upgrade
Upgrade redhat/containernetworking-plugins-debugsource to a version that resolves this vulnerability.
Fixed in 1.9.0-5.el9_8.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·05:52 PM

Data Sourced

via Red Hat·05:52 PM

Severity

Frequently Asked Questions

What kind of attack does this update address?

It addresses a denial-of-service issue in Go's net/http handling of crafted HTTP Range headers. An attacker would need to send specially crafted HTTP requests to an affected HTTP service.

Which deployments should be prioritized for remediation?

Prioritize affected containernetworking-plugins installations on the listed Red Hat Enterprise Linux offerings where exposed services may process HTTP requests. The advisory identifies the issue as an Important security update.

How can I determine whether my system is affected?

Check whether containernetworking-plugins or its related debuginfo/debugsource packages are installed on one of the listed Red Hat Enterprise Linux product streams, then compare the available update information with RHSA-2026:99088.

RHSA-2026:99088: Important: containernetworking-plugins security update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What kind of attack does this update address?

Which deployments should be prioritized for remediation?

How can I determine whether my system is affected?

Company

Resources

Contact

Frequently Asked Questions

What kind of attack does this update address?

Which deployments should be prioritized for remediation?

How can I determine whether my system is affected?