{"id":"CVE-2026-46600","title":"golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing (CVE-2026-46600)","summary":"A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may p…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-120","vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.15","affected":["externaldns_operator","file_integrity_operator","multicluster_engine_for_kubernetes","openshift_pipelines","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","openshift_container_platform 4","cert_manager_support_for_red_hat_openshift_release 1.17","cert_manager_support_for_red_hat_openshift_release 1.19","cert_manager_support_for_red_hat_openshift_release 1.20","cluster_observability_operator 1.5.3","compliance_operator 1","logging_subsystem_for_red_hat_openshift 6.0","logging_subsystem_for_red_hat_openshift 6.5","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","advanced_cluster_security_for_kubernetes_for_ibm_z_and_linuxone 4.11","openshift_builds 1.8.3","openshift_builds 1.9.2","openshift_distributed_tracing 3.10.2","openshift_distributed_tracing 3.11.3","multicluster_engine_for_kubernetes 2.10"],"patched":["cert_manager_support_for_red_hat_openshift_release 1.17","cert_manager_support_for_red_hat_openshift_release 1.19","cert_manager_support_for_red_hat_openshift_release 1.20","cluster_observability_operator 1.5.3","compliance_operator 1","logging_subsystem_for_red_hat_openshift 6.0","logging_subsystem_for_red_hat_openshift 6.5","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","advanced_cluster_security_for_kubernetes_for_ibm_z_and_linuxone 4.11","openshift_builds 1.8.3","openshift_builds 1.9.2","openshift_distributed_tracing 3.10.2","openshift_distributed_tracing 3.11.3","multicluster_engine_for_kubernetes 2.10"],"published":"2026-07-21","updated":"2026-10-25","sourceUpdated":"2026-10-25T06:51:34+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46600.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46600.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-46600"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2504234"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46600"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46600"},{"url":"https://go.dev/cl/786345"},{"url":"https://go.dev/issue/79795"},{"url":"https://pkg.go.dev/vuln/GO-2026-5942"},{"url":"https://access.redhat.com/errata/RHSA-2026:82322"},{"url":"https://access.redhat.com/errata/RHSA-2026:82304"},{"url":"https://access.redhat.com/errata/RHSA-2026:63135"},{"url":"https://access.redhat.com/errata/RHSA-2026:63138"},{"url":"https://access.redhat.com/errata/RHSA-2026:72475"},{"url":"https://access.redhat.com/errata/RHSA-2026:72395"},{"url":"https://access.redhat.com/errata/RHSA-2026:72399"},{"url":"https://access.redhat.com/errata/RHSA-2026:72476"},{"url":"https://access.redhat.com/errata/RHSA-2026:72470"},{"url":"https://access.redhat.com/errata/RHSA-2026:72394"},{"url":"https://access.redhat.com/errata/RHSA-2026:61314"},{"url":"https://access.redhat.com/errata/RHSA-2026:67707"},{"url":"https://access.redhat.com/errata/RHSA-2026:83013"},{"url":"https://access.redhat.com/errata/RHSA-2026:70870"},{"url":"https://access.redhat.com/errata/RHSA-2026:60387"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:72884"},{"url":"https://access.redhat.com/errata/RHSA-2026:60389"},{"url":"https://access.redhat.com/errata/RHSA-2026:60391"},{"url":"https://access.redhat.com/errata/RHSA-2026:72892"},{"url":"https://access.redhat.com/errata/RHSA-2026:60386"},{"url":"https://access.redhat.com/errata/RHSA-2026:72879"},{"url":"https://access.redhat.com/errata/RHSA-2026:67714"},{"url":"https://access.redhat.com/errata/RHSA-2026:54773"},{"url":"https://access.redhat.com/errata/RHSA-2026:69268"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00549,"epssPercentile":0.45788,"aliases":["GO-2026-5942"],"ecosystem":"go","ingestedAt":"2026-07-22T15:33:23.476Z","slug":"CVE-2026-46600","body":"## Overview\n\nA flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may panic due to a parameter value overflowing the message buffer. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable.\n\n## Vendor advisories\n\n- **RHSA-2026:82322** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82322)\n- **RHSA-2026:82304** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82304)\n- **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135)\n- **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138)\n- **RHSA-2026:72475** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72475)\n- **RHSA-2026:72395** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72395)\n- **RHSA-2026:72399** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72399)\n- **RHSA-2026:72476** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72476)\n- **RHSA-2026:72470** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72470)\n- **RHSA-2026:72394** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72394)\n- **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.3 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314)\n- **Red Hat VEX** · Important · affected: ExternalDNS Operator, File Integrity Operator, Multicluster Engine for Kubernetes, OpenShift Pipelines, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, ExternalDNS Operator, File Integrity Operator, Multicluster Engine for Kubernetes, … · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46600.json)\n- **RHSA-2026:67707** · Red Hat · fixed in: Compliance Operator 1 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67707)\n- **RHSA-2026:70870** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70870)\n- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389)\n- **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391)\n- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)\n- **RHSA-2026:67714** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67714)\n- **RHSA-2026:54773** · Red Hat · fixed in: Red Hat OpenShift distributed tracing 3.10.2 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54773)\n\n**golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing** — rated Important by Red Hat. Released 2026-07-21, updated 2026-10-25.\n\nAffected:\n\n- ExternalDNS Operator\n- File Integrity Operator\n- Multicluster Engine for Kubernetes\n- OpenShift Pipelines\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat OpenShift Container Platform 4\n\nFixed:\n\n- Cert Manager support for Red Hat OpenShift release 1.17\n- Cert Manager support for Red Hat OpenShift release 1.19\n- Cert Manager support for Red Hat OpenShift release 1.20\n- Cluster Observability Operator 1.5.3\n- Compliance Operator 1\n- Logging Subsystem for Red Hat OpenShift 6.0\n- Logging Subsystem for Red Hat OpenShift 6.5\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.15\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11\n- Red Hat OpenShift Builds 1.8.3\n- Red Hat OpenShift Builds 1.9.2\n- Red Hat OpenShift distributed tracing 3.10.2\n- Red Hat OpenShift distributed tracing 3.11.3\n- multicluster engine for Kubernetes 2.10\n\nNo fix planned:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- ExternalDNS Operator\n- File Integrity Operator\n- Multicluster Engine for Kubernetes\n- OpenShift Pipelines\n- Red Hat Advanced Cluster Security 4\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Cert Manager support for Red Hat OpenShift release 1.20\n- Cluster Observability Operator 1.5.3\n- Compliance Operator 1\n- Logging Subsystem for Red Hat OpenShift 6.0\n- Logging Subsystem for Red Hat OpenShift 6.5\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.15\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82322\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82304\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:63135\n\n## Package advisory (CVE-2026-46600)\n\nAffected packages:\n\n- `golang.org/x/net < 0.56.0`\n\nPatched in:\n\n- `golang.org/x/net 0.56.0`\n\nSource: https://osv.dev/vulnerability/GO-2026-5942","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":5257,"id":"CVE-2026-46600","ts":1788887257065,"field":"cvss","old":null,"new":"7.5"},{"seq":5256,"id":"CVE-2026-46600","ts":1788887257065,"field":"severity","old":"none","new":"high"},{"seq":4140,"id":"CVE-2026-46600","ts":1788886373488,"field":"cvss","old":"7.5","new":null},{"seq":4139,"id":"CVE-2026-46600","ts":1788886373488,"field":"severity","old":"high","new":"none"},{"seq":3177,"id":"CVE-2026-46600","ts":1788883133247,"field":"cvss","old":null,"new":"7.5"},{"seq":3176,"id":"CVE-2026-46600","ts":1788883133247,"field":"severity","old":"none","new":"high"}]}