RHSA-2026:28047

Details:

etcd is a highly-available key value store for shared configuration.

Security Fix(es):

• net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

• golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

• Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

• Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

• crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

• golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

• google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

• golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

• crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)

• internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

• etcd: Authorization bypass allows information disclosure and denial of service (CVE-2026-33413)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.