CLSA-2026-1789570040
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1789570040.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789570040
- Upstream
CVE (6)
- CVE-2026-33818
- CVE-2026-39821
- CVE-2026-56858
- CVE-2026-56859
- CVE-2026-56860
- CVE-2026-56862
- Published
- 2026-09-16T14:47:34Z
- Modified
- 2026-10-26T09:43:10Z
- Summary
- ignition: Fix of 6 CVEs
- Details
-
- CVE-2026-39821: reject xn-- labels that decode to an all-ASCII label in idna ToASCII/ToUnicode, preventing hostname authorization bypass
- CVE-2026-33818: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which enforces a recursion limit in encoding/asn1 Unmarshal
- CVE-2026-56858: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which fixes the html/template JavaScript context tracking XSS
- CVE-2026-56859: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which adds a recursion depth guard in encoding/xml decoding
- CVE-2026-56860: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which avoids quadratic complexity in net/url path resolution
- CVE-2026-56862: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which stops counting post-handshake crypto/tls KeyUpdate messages as state-advancing
- References
-
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1789570040.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-33818
- https://nvd.nist.gov/vuln/detail/CVE-2026-39821
- https://nvd.nist.gov/vuln/detail/CVE-2026-56858
- https://nvd.nist.gov/vuln/detail/CVE-2026-56859
- https://nvd.nist.gov/vuln/detail/CVE-2026-56860
- https://nvd.nist.gov/vuln/detail/CVE-2026-56862
Affected packages
TuxCare:AlmaLinux:9.2 / ignition
Package
- Name
- ignition
- Purl
- pkg:rpm/tuxcare/ignition?distro=almalinux-9.2
TuxCare:AlmaLinux:9.2 / ignition-edge
Package
- Name
- ignition-edge
- Purl
- pkg:rpm/tuxcare/ignition-edge?distro=almalinux-9.2