RLSA-2026:98502: Important: gvisor-tap-vsock security update
A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.
Security Fix(es):
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/gvisor-tap-vsockto a version that resolves this vulnerability.Fixed in 6:0.8.8-2.el9_9 - Upgrade
Upgrade
rocky-linux/gvisor-tap-vsock-debuginfoto a version that resolves this vulnerability.Fixed in 6:0.8.8-2.el9_9 - Upgrade
Upgrade
rocky-linux/gvisor-tap-vsock-debugsourceto a version that resolves this vulnerability.Fixed in 6:0.8.8-2.el9_9 - Upgrade
Upgrade
rocky-linux/gvisor-tap-vsock-gvforwarderto a version that resolves this vulnerability.Fixed in 6:0.8.8-2.el9_9 - Upgrade
Upgrade
rocky-linux/gvisor-tap-vsock-gvforwarder-debuginfoto a version that resolves this vulnerability.Fixed in 6:0.8.8-2.el9_9
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which installed components are covered by this update?
The update covers rocky-linux/gvisor-tap-vsock and its debuginfo, debugsource, gvforwarder, and gvforwarder-debuginfo packages.
What types of attacks are addressed?
The listed fixes include several denial-of-service issues affecting ASN.1 parsing, HTTP/2, HTTP Range header handling, TLS KeyUpdate and ECH processing, and multipart form parsing. It also addresses a man-in-the-middle issue involving untrusted intermediate certificates in crypto/x509.
Does exploiting these issues require authentication or user interaction?
The advisory's supplied severity vector is AV:N/AC:L/PR:N/UI:N, indicating network reachability, low attack complexity, no privileges required, and no user interaction required.