--- id: CVE-2026-46600 title: >- golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing (CVE-2026-46600) summary: >- A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may p… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-120 vendor: Red Hat product: Multicluster Engine for Kubernetes affected: - externaldns_operator - file_integrity_operator - multicluster_engine_for_kubernetes - openshift_pipelines - advanced_cluster_management_for_kubernetes 2 - advanced_cluster_security 4 - openshift_container_platform 4 - cert_manager_support_for_red_hat_openshift_release 1.19 - cluster_observability_operator 1.5.0 - logging_subsystem_for_red_hat_openshift 6.5 - openshift_compliance_operator 1 - advanced_cluster_management_for_kubernetes 2.11 - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - advanced_cluster_management_for_kubernetes 2.15 - advanced_cluster_management_for_kubernetes 2.16 - advanced_cluster_management_for_kubernetes 2.17 - advanced_cluster_security_for_kubernetes 4.11 - openshift_distributed_tracing 3.10.2 - openshift_distributed_tracing 3.11.1 patched: - cert_manager_support_for_red_hat_openshift_release 1.19 - cluster_observability_operator 1.5.0 - logging_subsystem_for_red_hat_openshift 6.5 - openshift_compliance_operator 1 - advanced_cluster_management_for_kubernetes 2.11 - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - advanced_cluster_management_for_kubernetes 2.15 - advanced_cluster_management_for_kubernetes 2.16 - advanced_cluster_management_for_kubernetes 2.17 - advanced_cluster_security_for_kubernetes 4.11 - openshift_distributed_tracing 3.10.2 - openshift_distributed_tracing 3.11.1 published: '2026-07-21' updated: '2026-09-26' sourceUpdated: '2026-09-26T01:34:41+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46600.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46600.json - url: 'https://access.redhat.com/security/cve/CVE-2026-46600' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2504234' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-46600' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46600' - url: 'https://go.dev/cl/786345' - url: 'https://go.dev/issue/79795' - url: 'https://pkg.go.dev/vuln/GO-2026-5942' - url: 'https://access.redhat.com/errata/RHSA-2026:63135' - url: 'https://access.redhat.com/errata/RHSA-2026:63138' - url: 'https://access.redhat.com/errata/RHSA-2026:61314' - url: 'https://access.redhat.com/errata/RHSA-2026:70870' - url: 'https://access.redhat.com/errata/RHSA-2026:67707' - url: 'https://access.redhat.com/errata/RHSA-2026:60387' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:60389' - url: 'https://access.redhat.com/errata/RHSA-2026:60391' - url: 'https://access.redhat.com/errata/RHSA-2026:60386' - url: 'https://access.redhat.com/errata/RHSA-2026:67714' - url: 'https://access.redhat.com/errata/RHSA-2026:54773' - url: 'https://access.redhat.com/errata/RHSA-2026:69268' tags: - csaf - vex - red-hat - osv - go epss: 0.0063 epssPercentile: 0.47972 aliases: - GO-2026-5942 ecosystem: go ingestedAt: '2026-07-22T15:33:23.476Z' --- ## Overview A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may panic due to a parameter value overflowing the message buffer. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable. ## Vendor advisories - **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135) - **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138) - **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314) - **RHSA-2026:70870** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70870) - **RHSA-2026:67707** · Red Hat · fixed in: OpenShift Compliance Operator 1 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67707) - **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387) - **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390) - **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388) - **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389) - **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391) - **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386) - **Red Hat VEX** · Important · affected: ExternalDNS Operator, File Integrity Operator, Multicluster Engine for Kubernetes, OpenShift Pipelines, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, ExternalDNS Operator, File Integrity Operator, Multicluster Engine for Kubernetes, … · updated 2026-09-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46600.json) - **RHSA-2026:67714** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67714) - **RHSA-2026:54773** · Red Hat · fixed in: Red Hat OpenShift distributed tracing 3.10.2 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54773) **golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing** — rated Important by Red Hat. Released 2026-07-21, updated 2026-09-26. Affected: - ExternalDNS Operator - File Integrity Operator - Multicluster Engine for Kubernetes - OpenShift Pipelines - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat OpenShift Container Platform 4 Fixed: - Cert Manager support for Red Hat OpenShift release 1.19 - Cluster Observability Operator 1.5.0 - Logging Subsystem for Red Hat OpenShift 6.5 - OpenShift Compliance Operator 1 - Red Hat Advanced Cluster Management for Kubernetes 2.11 - Red Hat Advanced Cluster Management for Kubernetes 2.13 - Red Hat Advanced Cluster Management for Kubernetes 2.14 - Red Hat Advanced Cluster Management for Kubernetes 2.15 - Red Hat Advanced Cluster Management for Kubernetes 2.16 - Red Hat Advanced Cluster Management for Kubernetes 2.17 - Red Hat Advanced Cluster Security for Kubernetes 4.11 - Red Hat OpenShift distributed tracing 3.10.2 - Red Hat OpenShift distributed tracing 3.11.1 No fix planned: - Red Hat Advanced Cluster Management for Kubernetes 2 - ExternalDNS Operator - File Integrity Operator - Multicluster Engine for Kubernetes - OpenShift Pipelines - Red Hat Advanced Cluster Security 4 - Red Hat OpenShift Container Platform 4 Not affected: - Cluster Observability Operator 1.5.0 - Logging Subsystem for Red Hat OpenShift 6.5 - OpenShift Compliance Operator 1 - Red Hat Advanced Cluster Management for Kubernetes 2.11 - Red Hat Advanced Cluster Management for Kubernetes 2.13 - Red Hat Advanced Cluster Management for Kubernetes 2.14 - Red Hat Advanced Cluster Management for Kubernetes 2.15 - Red Hat Advanced Cluster Management for Kubernetes 2.16 - Red Hat Advanced Cluster Management for Kubernetes 2.17 - Red Hat Advanced Cluster Security for Kubernetes 4.11 ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:63135 Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:63138 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:61314 ## Package advisory (CVE-2026-46600) Affected packages: - `golang.org/x/net < 0.56.0` Patched in: - `golang.org/x/net 0.56.0` Source: https://osv.dev/vulnerability/GO-2026-5942