SB20260415156 - Red Hat Enterprise Linux 9 update for rhc

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2023-44487)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improperly control of consumption for internal resources when handling HTTP/2 requests with compressed HEADERS frames. A remote attacker can send a sequence of compressed HEADERS frames followed by RST_STREAM frames and perform a denial of service (DoS) attack, a.k.a. "Rapid Reset".

Note, the vulnerability is being actively exploited in the wild.

2) Resource exhaustion (CVE-ID: CVE-2023-39325)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to excessive consumption of internal resources when handling HTTP/2 requests. A remote attacker can bypass the http2.Server.MaxConcurrentStreams setting by creating new connections while the current connections are still being processed, trigger resource exhaustion and perform a denial of service (DoS) attack.

3) Input validation error (CVE-ID: CVE-2026-25679)

The vulnerability allows a remote attacker to bypass URL parsing validation and potentially access unintended resources.

The vulnerability exists due to insufficient validation in net/url.Parse when handling IPv6 literals not located at the start of the host component. A remote attacker can send a specially crafted URL with an IPv6 literal preceded by garbage characters to bypass proper parsing and potentially redirect requests.

This issue affects any application using net/url.Parse to process untrusted URLs. The incorrect parsing may lead to misrouting or injection of unintended host components.

Remediation

Install update from vendor's website.

References

• https://access.redhat.com/errata/RHSA-2026:8322