Loading story…
Red Hat released Important-severity updates for Red Hat Service Interconnect 1.4 and 1.5, RHEL 9.2 Go packages, and Red Hat OpenStack Platform 17.1 director Operator images to remediate multiple Go vulnerabilities. Key issues include CVE-2023-45288, where unlimited HTTP/2 CONTINUATION frames can exhaust resources; CVE-2024-24783, which can panic crypto/x509 certificate verification when an unknown public-key algorithm is processed; and CVE-2023-39326, in which oversized HTTP chunk extensions can drive server memory consumption to roughly 1 GiB. The OpenStack update also fixes CVE-2023-48795, an SSH Binary Packet Protocol prefix-truncation flaw.
Red Hat additionally updated OpenShift Container Platform 4.13 and 4.14 releases for CVE-2024-1394, a memory leak in golang-fips/openssl RSA encryption and decryption operations; OpenShift 4.14.19 also addresses CVE-2024-28180, involving improper handling of highly compressed data in jose-go. Affected organizations should update Service Interconnect images and skupper-cli, deploy the updated RHEL Go packages and OpenStack operator images, and upgrade OpenShift clusters through their supported release channels across x86_64, ARM64, IBM Power, and IBM Z/LinuxONE where applicable.
See real exploitation activity before you spend the cycle.
19 events from the most recent confirmed update back to the earliest known activity.
RHSA-2024:4146 provided golang-1.19.13-7.el9_2 for affected RHEL 9.2 support channels and architectures. The Important update fixed CVE-2023-45288 and CVE-2024-1394.
Red Hat issued RHSA-2024:4126, an Important update providing Service Interconnect 1.4.5 container images for RHEL 9 x86_64. It addressed CVE-2024-24783, CVE-2023-45288, and additional listed Go vulnerabilities.
RHSA-2024:4125 released Service Interconnect 1.4.5 packages, including skupper-cli for RHEL 8 and RHEL 9 x86_64. The update remediated CVE-2024-24783 and the HTTP/2 CONTINUATION-frame denial-of-service flaw CVE-2023-45288.
Red Hat issued RHSA-2024:4034 for Service Interconnect 1.5.4 OpenShift container images. The Important update fixed Go CVE-2023-45288 and CVE-2024-24783, as well as Service Interconnect issues SKUPPER-1705 and SKUPPER-1812.
Red Hat issued RHSA-2024:3479, an Important update for director Operator container images in Red Hat OpenStack Platform 16.2 (Train) on RHEL 8.4. The update remediated Go-related CVE-2023-39326, CVE-2023-45288, CVE-2023-48795, and goproxy denial-of-service flaw CVE-2023-37788.
RHSA-2024:2728 delivered updated Red Hat OpenStack Platform 17.1 director Operator images for RHEL 9.2, addressing CVE-2023-39326, CVE-2023-45288, and CVE-2023-48795.
Red Hat issued RHSA-2024:3314 for OpenShift Virtualization 4.15.2 images for Red Hat Container Native Virtualization 4.15 on RHEL 9 x86_64. The Important update fixed the Go HTTP/2 CONTINUATION-frame denial-of-service flaw CVE-2023-45288, follow-redirects URL-validation flaw CVE-2023-26159, and axios cookie-data exposure CVE-2023-45857.
Red Hat issued RHSA-2024:2729 for Red Hat OpenStack Platform 17.1 on RHEL 9 x86_64, updating etcd to 3.4.26-8.el9ost. The Important advisory fixed the incomplete etcd HTTP/2 DoS mitigation CVE-2024-4438 and Go-related CVE-2023-39326, CVE-2023-45287, CVE-2023-45288, and CVE-2024-1394.
Red Hat issued RHSA-2024:2941 for Red Hat Advanced Cluster Security 4.4.2, updating Go and golang.org/x/net to address the HTTP/2 CONTINUATION-frame denial-of-service flaw CVE-2023-45288. The Important advisory also fixed webpack-dev-middleware file-disclosure flaw CVE-2024-29180 and multiple RHACS Collector, Scanner, network-graph, and alert-handling issues.
Red Hat issued RHSA-2024:1763, an Important update for OpenShift Container Platform 4.13.40, to remediate CVE-2024-1394 memory leaks during RSA payload encryption and decryption in golang-fips/openssl.
Red Hat issued RHSA-2024:1901 for Red Hat Service Interconnect 1.5.3 OpenShift container images on RHEL 9. The Moderate update remediated multiple Go flaws, including CVE-2023-39318, CVE-2023-39319, CVE-2023-39321, CVE-2023-39322, CVE-2023-45287, and CVE-2023-39326, and fixed Skupper defects including SKUPPER-1304, SKUPPER-1338, SKUPPER-1463, and SKUPPER-976.
Red Hat issued RHSA-2024:1567 for OpenShift Container Platform 4.14.19, fixing CVE-2024-1394 memory leaks in golang-fips/openssl and CVE-2024-28180 improper handling of highly compressed jose-go data.
Red Hat published CVE-2023-45290, a Moderate Go net/http vulnerability where extremely long multipart-form lines could bypass aggregate form-size limits, causing arbitrarily large memory allocations and denial of service. The fix enforces a maximum size for individual multipart form lines in ParseMultipartForm.
Red Hat published CVE-2024-24783, a Moderate Go crypto/x509 flaw in which Certificate.Verify can panic on a certificate chain containing an unknown public-key algorithm. A remote attacker could trigger the fault by supplying a crafted client certificate to affected TLS services configured to verify client certificates.
Patrick Del Bello documented GO-2023-2382, a Go net/http chunked-transfer decoding flaw in which oversized chunk extensions could cause excessive network reads and denial of service.
Robb Gatica disclosed CVE-2023-45857 in Axios 1.5.1, where the XSRF-TOKEN cookie value could be added to the X-XSRF-TOKEN header for requests to any host. An attacker-controlled host could receive the sensitive token if induced to receive such a request.
Red Hat tracked CVE-2023-26159 in follow-redirects versions before 1.15.4, where fallback from the URL() parser to url.parse() could allow hostname misinterpretation and redirects to attacker-controlled sites. Red Hat issued or tracked remediations across RHOL, Migration Toolkit for Applications, Network Observability, OpenShift distributed tracing, OpenShift Container Platform, MCE, and other products.
Red Hat tracked CVE-2023-45287 (GO-2023-2375), affecting Go versions before 1.20 during RSA-based TLS key exchanges. Non-constant-time math/big operations and PKCS#1 padding removal could leak timing information; Go 1.20 introduced a fully constant-time RSA implementation in crypto/tls.
Red Hat issued updates for RHEL 7, 8, and 9 and numerous products containing affected Go components to address GO-2023-2382/CVE-2023-39326. The remediation makes Go's chunked-encoding reader reject inputs with an excessively low ratio of body data to encoded bytes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
19 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released security updates across **OpenShift Container Platform (OCP) 4.12 through 4.16** and OpenShift Serverless, remediating vulnerabilities in bundled Go, Linux kernel, glibc, OpenTelemetry, BIND, Ironic, Gunicorn, Werkzeug, and related components. The issues include HTTP/2 and multipart-form memory-exhaustion denial of service—such as `CVE-2023-45288` and `CVE-2023-45290`—sensitive URL data written to logs (`CVE-2024-6104`), cluster-monitoring credential leakage, unauthenticated local access and data exposure in OpenStack Ironic, and an SSH prefix-truncation attack. OpenShift 4.16.0 addressed 16 vulnerabilities, while the 4.14.39 update also fixed a glibc `iconv` out-of-bounds write that may allow remote code execution. Affected organizations should update OCP container images and packages through their supported release channels using the OpenShift CLI or web console, prioritizing deployed 4.12, 4.14, 4.15, and 4.16 clusters. The advisories cover RHEL 8 and RHEL 9 deployments across `x86_64`, `s390x`, `ppc64le`, and `aarch64` where applicable; OpenShift Serverless 1.33.0 also updates Serverless Operator components for OCP 4.12–4.16. Red Hat separately updated the RHEL 9 Go toolchain to version `golang-1.21.9-2.el9_4`, addressing HTTP processing, certificate-verification, redirect-forwarding, template escaping, and cryptographic flaws that affect Go-based workloads and platform components.
Aug 27, 2026
Red Hat released security updates across OpenShift Container Platform (OCP), OpenShift Serverless, Service Mesh, API for Data Protection (OADP), Advanced Cluster Security, Virtualization, Distributed Tracing, Cryostat, and related operators. The advisories remediate multiple Go defects, led by **CVE-2022-41723**, an HTTP/2 HPACK-decoding flaw that lets crafted streams consume excessive CPU through quadratic processing and cause denial of service. Updates also address **CVE-2022-41717**, where oversized HTTP/2 header keys can allocate roughly 64 MiB per connection, and **CVE-2022-41715**, which allows certain regular expressions to drive disproportionate memory use during parsing. Several releases additionally fix **CVE-2023-25173** in containerd, which could allow a user with container access to manipulate supplementary-group permissions and bypass primary-group restrictions within that container. OCP 4.13 updates also remediate the FIPS-mode issue tracked as **CVE-2023-3089**, Kubernetes privilege-escalation and runc mount-race issues, plus other Go resource-exhaustion and template-processing flaws. Red Hat advises affected customers to upgrade packages and container images through supported OpenShift release channels; environments using vulnerable standalone containerd versions should upgrade to 1.6.18 or 1.5.18 and recreate containers.
Aug 28, 2026
Red Hat released security updates across **OpenShift Container Platform**, OpenShift Data Foundation, OpenShift Serverless, distributed tracing, and the Red Hat build of Cryostat. The updates remediate vulnerabilities in shared Go, OpenSSH, networking, image-handling, and third-party libraries that could enable denial of service, resource exhaustion, memory leakage, sensitive-information exposure, or improper privilege propagation. Affected deployments span RHEL 8 and RHEL 9 and supported x86_64, ARM64, IBM Power, and IBM Z/LinuxONE architectures. Notable fixes include **CVE-2023-48795** (Terrapin), which permits an active attacker to truncate initial SSH secure-channel messages under vulnerable ChaCha20-Poly1305 or Encrypt-then-MAC configurations, and **CVE-2024-1394**, an RSA error-path memory leak in `golang-fips/openssl` that can cause resource exhaustion. OpenShift Container Platform updates also address a possible OpenSSH remote-code-execution condition on RHEL 9 associated with a signal-handling race. Red Hat advised customers to install relevant prior errata and upgrade clusters and operators through their supported release channels; temporary Terrapin mitigations include disabling `chacha20-poly1305` and EtM MAC algorithms where updates cannot be deployed immediately.
Aug 27, 2026