SB20260731103 - Multiple vulnerabilities in OpenShift Logging 6.0
Published: July 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-25679)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass URL parsing validation and potentially access unintended resources.
The vulnerability exists due to insufficient validation in net/url.Parse when handling IPv6 literals not located at the start of the host component. A remote attacker can send a specially crafted URL with an IPv6 literal preceded by garbage characters to bypass proper parsing and potentially redirect requests.
This issue affects any application using net/url.Parse to process untrusted URLs. The incorrect parsing may lead to misrouting or injection of unintended host components.
2) Improper Authorization (CVE-ID: CVE-2026-27137)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass email address constraints during X.509 certificate chain verification.
The vulnerability exists due to improper enforcement of email constraints in crypto/x509 when verifying certificate chains containing multiple email address constraints with shared local parts but different domains. A remote attacker can present a certificate chain with malformed email constraints to cause only the last constraint to be applied, leading to improper validation.
This issue only affects Go 1.26 and requires the certificate chain to chain to a trusted root. A trusted CA must issue the malicious certificate.
3) Resource exhaustion (CVE-ID: CVE-2026-32280)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the Certificate.Verify chain-building logic in crypto/x509 when processing a large number of intermediate certificates supplied through VerifyOptions.Intermediates. A remote attacker can provide a large number of intermediate certificates to cause a denial of service.
This affects both direct users of crypto/x509 and users of crypto/tls.
4) Input validation error (CVE-ID: CVE-2026-32281)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in Certificate.Verify in crypto/x509 when validating certificate chains containing a very large number of policy mappings. A remote attacker can present a specially crafted certificate chain to cause a denial of service.
This only affects validation of otherwise trusted certificate chains issued by a root CA in the VerifyOptions.Roots CertPool or in the system certificate pool.
5) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-32282)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to modify file permissions outside the intended root directory.
The vulnerability exists due to improper access control in Root.Chmod and internal/syscall/unix Fchmodat when handling a chmod operation on Linux. A local user can replace the target with a symlink during the check-and-operation window to modify file permissions outside the intended root directory.
Exploitation requires a race condition in which the target is swapped with a symlink while the chmod operation is in progress.
6) Improper Certificate Validation (CVE-ID: CVE-2026-33810)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass certificate name constraints.
The vulnerability exists due to improper certificate validation in the Certificate.Verify function in crypto/x509 when verifying a certificate chain containing excluded DNS constraints and wildcard DNS SANs that use different letter case than the constraint. A remote attacker can present a specially crafted certificate chain to bypass certificate name constraints.
This only affects validation of otherwise trusted certificate chains issued by a root CA in the VerifyOptions.Roots CertPool or in the system certificate pool.
7) Improper input validation (CVE-ID: CVE-2026-34986)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in JWE decryption in key_wrap.go when processing a JWE object with a key wrapping algorithm and an empty encrypted_key field. A remote attacker can send a specially crafted JWE object to cause a denial of service.
The issue is reachable through ParseEncrypted(), ParseEncryptedJSON(), or ParseEncryptedCompact() followed by Decrypt(), and applications are affected only if accepted key algorithms include key wrapping algorithms.
Remediation
Install update from vendor's website.