{"id":"CVE-2026-46600","title":"golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing (CVE-2026-46600)","summary":"A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may p…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-120","vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","affected":["externaldns_operator","file_integrity_operator","logging_subsystem_for_red_hat_openshift","multicluster_engine_for_kubernetes","openshift_pipelines","advanced_cluster_management_for_kubernetes 2","openshift_container_platform 4","cert_manager_support_for_red_hat_openshift_release 1.19","cluster_observability_operator 1.5.0","openshift_compliance_operator 1","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","advanced_cluster_security_for_kubernetes 4.11","openshift_distributed_tracing 3.10.2","openshift_distributed_tracing 3.11.1"],"patched":["cert_manager_support_for_red_hat_openshift_release 1.19","cluster_observability_operator 1.5.0","openshift_compliance_operator 1","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","advanced_cluster_security_for_kubernetes 4.11","openshift_distributed_tracing 3.10.2","openshift_distributed_tracing 3.11.1"],"published":"2026-07-21","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:35:43+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46600.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46600.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-46600"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2504234"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46600"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46600"},{"url":"https://go.dev/cl/786345"},{"url":"https://go.dev/issue/79795"},{"url":"https://pkg.go.dev/vuln/GO-2026-5942"},{"url":"https://access.redhat.com/errata/RHSA-2026:63135"},{"url":"https://access.redhat.com/errata/RHSA-2026:63138"},{"url":"https://access.redhat.com/errata/RHSA-2026:61314"},{"url":"https://access.redhat.com/errata/RHSA-2026:67707"},{"url":"https://access.redhat.com/errata/RHSA-2026:60387"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:60389"},{"url":"https://access.redhat.com/errata/RHSA-2026:60391"},{"url":"https://access.redhat.com/errata/RHSA-2026:60386"},{"url":"https://access.redhat.com/errata/RHSA-2026:67714"},{"url":"https://access.redhat.com/errata/RHSA-2026:54773"},{"url":"https://access.redhat.com/errata/RHSA-2026:69268"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00549,"epssPercentile":0.44847,"aliases":["GO-2026-5942"],"ecosystem":"go","ingestedAt":"2026-07-22T15:33:23.476Z","slug":"CVE-2026-46600","body":"## Overview\n\nA flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may panic due to a parameter value overflowing the message buffer. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable.\n\n## Vendor advisories\n\n- **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135)\n- **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138)\n- **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314)\n- **RHSA-2026:67707** · Red Hat · fixed in: OpenShift Compliance Operator 1 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67707)\n- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389)\n- **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391)\n- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)\n- **RHSA-2026:67714** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67714)\n- **Red Hat VEX** · Important · affected: ExternalDNS Operator, File Integrity Operator, Logging Subsystem for Red Hat OpenShift, Multicluster Engine for Kubernetes, OpenShift Pipelines, Red Hat Advanced Cluster Management for Kubernetes 2, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, ExternalDNS Operator, File Integrity Operator, Logging Subsystem for Red Hat OpenShift, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46600.json)\n- **RHSA-2026:54773** · Red Hat · fixed in: Red Hat OpenShift distributed tracing 3.10.2 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54773)\n\n**golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing** — rated Important by Red Hat. Released 2026-07-21, updated 2026-09-21.\n\nAffected:\n\n- ExternalDNS Operator\n- File Integrity Operator\n- Logging Subsystem for Red Hat OpenShift\n- Multicluster Engine for Kubernetes\n- OpenShift Pipelines\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat OpenShift Container Platform 4\n\nFixed:\n\n- Cert Manager support for Red Hat OpenShift release 1.19\n- Cluster Observability Operator 1.5.0\n- OpenShift Compliance Operator 1\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.15\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Advanced Cluster Security for Kubernetes 4.11\n- Red Hat OpenShift distributed tracing 3.10.2\n- Red Hat OpenShift distributed tracing 3.11.1\n\nNo fix planned:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- ExternalDNS Operator\n- File Integrity Operator\n- Logging Subsystem for Red Hat OpenShift\n- Multicluster Engine for Kubernetes\n- OpenShift Pipelines\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Cluster Observability Operator 1.5.0\n- OpenShift Compliance Operator 1\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.15\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Advanced Cluster Security for Kubernetes 4.11\n- Red Hat OpenShift distributed tracing 3.10.2\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:63135\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:63138\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:61314\n\n## Package advisory (CVE-2026-46600)\n\nAffected packages:\n\n- `golang.org/x/net < 0.56.0`\n\nPatched in:\n\n- `golang.org/x/net 0.56.0`\n\nSource: https://osv.dev/vulnerability/GO-2026-5942","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":5257,"id":"CVE-2026-46600","ts":1788887257065,"field":"cvss","old":null,"new":"7.5"},{"seq":5256,"id":"CVE-2026-46600","ts":1788887257065,"field":"severity","old":"none","new":"high"},{"seq":4140,"id":"CVE-2026-46600","ts":1788886373488,"field":"cvss","old":"7.5","new":null},{"seq":4139,"id":"CVE-2026-46600","ts":1788886373488,"field":"severity","old":"high","new":"none"},{"seq":3177,"id":"CVE-2026-46600","ts":1788883133247,"field":"cvss","old":null,"new":"7.5"},{"seq":3176,"id":"CVE-2026-46600","ts":1788883133247,"field":"severity","old":"none","new":"high"}]}