Red Hat Product Errata RHSA-2026:54757 - Security Advisory Issued: 2026-08-13 Updated: 2026-08-13 RHSA-2026:54757 - Security Advisory Overview Updated Packages Synopsis Important: Red Hat OpenStack Platform 16.2 security advisory Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for Red Hat OpenStack Platform 16.2 (Train) is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware. Security Fix(es): crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova (CVE-2026-24708) pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490) golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121) openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access (CVE-2026-34881) crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) etcd: etcd: Authorization bypass allows information disclosure and denial of service (CVE-2026-33413) crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) golang.org/x/net/idna: golang: net/ http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation (CVE-2026-42789) crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) oslo.messaging: openstack: OpenStack oslo.messaging: Man-in-the-middle attack via improper TLS hostname verification (CVE-2026-44393) erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing (CVE-2026-42790) openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw (CVE-2025-65073) OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation (CVE-2026-43001) openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation (CVE-2026-33551) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat OpenStack for IBM Power 16.2 ppc64le Red Hat OpenStack 16.2 x86_64 Red Hat OpenStack Director Deployment Tools 16.2 x86_64 Red Hat OpenStack Director Deployment Tools for IBM Power LE 16.2 ppc64le Red Hat Enterprise Linux for x86_64 8 x86_64 Cinderlib 16.2 x86_64 Cinderlib for IBM Power LE 16.2 ppc64le Fixes BZ - 2415344 - CVE-2025-65073 openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw BZ - 2418462 - CVE-2025-61729 crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate BZ - 2430312 - CVE-2026-24708 openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova BZ - 2430472 - CVE-2026-23490 pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID BZ - 2434432 - CVE-2025-61726 golang: net/url: Memory exhaustion in query parameter parsing in net/url BZ - 2437111 - CVE-2025-68121 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption BZ - 2440368 - CVE-2026-34881 openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access BZ - 2445345 - CVE-2026-27137 crypto/x509: Incorrect enforcement of email constraints in crypto/x509 BZ - 2445356 - CVE-2026-25679 net/url: Incorrect parsing of IPv6 host literals in net/url BZ - 2449833 - CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation BZ - 2451037 - CVE-2026-33551 openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation BZ - 2451728 - CVE-2026-33413 etcd: etcd: Authorization bypass allows information disclosure and denial of service BZ - 2456333 - CVE-2026-32281 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation BZ - 2456335 - CVE-2026-33810 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application BZ - 2456336 - CVE-2026-32282 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root BZ - 2456338 - CVE-2026-32283 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages BZ - 2456339 - CVE-2026-32280 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building BZ - 2464305 - CVE-2026-43001 OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation BZ - 2467822 - CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing BZ - 2482093 - CVE-2026-42789 erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation BZ - 2482286 - CVE-2026-42790 erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing BZ - 2484207 - CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries BZ - 2484835 - CVE-2026-44393 oslo.messaging: openstack: OpenStack oslo.messaging: Man-in-the-middle attack via improper TLS hostname verification OSPRH-20808 - [16.2] Do not rotate SwiftHashSuffix CVEs CVE-2025-61726 CVE-2025-61729 CVE-2025-65073 CVE-2025-68121 CVE-2026-23490 CVE-2026-24708 CVE-2026-25679 CVE-2026-27137 CVE-2026-27145 CVE-2026-32280 CVE-2026-32281 CVE-2026-32282 CVE-2026-32283 CVE-2026-33186 CVE-2026-33413 CVE-2026-33551 CVE-2026-33810 CVE-2026-33811 CVE-2026-34881 CVE-2026-39821 CVE-2026-42789 CVE-2026-42790 CVE-2026-43001 CVE-2026-44393 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat OpenStack for IBM Power 16.2 SRPM collectd-sensubility-0.2.1-1.1.el8ost.src.rpm SHA-256: fb231d66381f17b357d8ef6e23d40ab3aa9643d44c47387cc7cc68ce82abfd1f erlang-23.3.4.18-2.el8ost.src.rpm SHA-256: 82f9d7ea6b5effb156ff0785de2fded15250fbf3a7886736f9030bdb6dc00039 etcd-3.3.23-22.el8ost.src.rpm SHA-256: 605b35d4bbbd5518df4837292074f5cb9fb059c047a6adc2d5f759507380023d openstack-cinder-15.6.1-2.20250708154832.299553a.el8ost.src.rpm SHA-256: 7cc110658649f0fe0a2a8a687b586942e798416c189141f5e35bc5e5766ce9c9 openstack-glance-19.0.5-2.20260512165254.eb6ad61.el8ost.src.rpm SHA-256: 65916c7bfcf2b232cff57052cad69ad233fd89c91210b11c4b615447ded76bfb openstack-keystone-16.0.3-2.20260616134936.9d699a7.el8ost.src.rpm SHA-256: f185a9d89bbaecf4cf60743fd1644002913b4d37c16feb187592511758d3cfac openstack-nova-20.6.2-2.20260317135026.8a24acd.el8ost.src.rpm SHA-256: 134b8898f5c261169d4a9201c70c4748c3d2ccdb118898a8402b6c2271326f7d openstack-swift-2.23.4-2.20260121154927.70b68db.el8ost.src.rpm SHA-256: d61d108ce5a24dd8e1dc11e93d40c77d0efb26da9de5add37f1176f74719c9f6 openstack-tempest-26.1.0-2.20250728145114.271f820.el8ost.src.rpm SHA-256: 8a929b7391dee95c15e22cad81fe6b0e72a17d72a6da33a08d91977b26ed896e openstack-tripleo-common-11.7.1-2.20251029134905.e189622.el8ost.src.rpm SHA-256: 63dd1acee8a5606db3dadef5a5aa3499d927a298764ae31f55c8f4d87c8470c2 openstack-tripleo-heat-templates-11.6.1-2.20251125134914.9adcac6.el8ost.src.rpm SHA-256: 12b700f080e94b0a758d548d32b4aaa09fe9af5328d387649ef167d112314052 puppet-apache-5.1.1-2.20250728133931.1fa9b1c.el8ost.src.rpm SHA-256: fec54cd54760f8ebc61a42544435ae379ef92b8a81e5078b6b9d4b384b46a299 puppet-concat-6.1.1-2.20250728133127.9baa8fc.el8ost.src.rpm SHA-256: 7e91ac1ed8ae27834e2f1c0aa3f9d05dd8ec4bfb43ad5f60a2c0191dba03d992 puppet-corosync-6.0.2-2.20250728134759.961add3.el8ost.src.rpm SHA-256: 8ab494694207dc8cac53a79