# RHSA-2026:41019: flightctl security update RHSA-2026:41019, released May 22, 2026, fixes 22 CVEs in flightctl (version 1.1.3-1.el10em). None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/rhsa-2026-41019 - Platform: Linux - Released: May 22, 2026 - Priority: Urgent (Closes CVE-2026-39821, rated Critical) - CVEs: 22, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://access.redhat.com/errata/RHSA-2026:41019 ## Applies to | Product | Release | Fixed in | |---|---|---| | [flightctl](https://patchblox.com/security/data/product/linux/flightctl.md) | RHEL 10 | 1.1.3-1.el10em | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-39821](https://patchblox.com/security/data/cve/CVE-2026-39821.md) | Urgent | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | 10.0 | 0.0183 | | | [CVE-2026-33815](https://patchblox.com/security/data/cve/CVE-2026-33815.md) | Urgent | golang-github-jackc-pgx-v5: Memory-safety vulnerability in github.com/jackc/pgx/v5. | 9.8 | 0.0063 | | | [CVE-2026-33816](https://patchblox.com/security/data/cve/CVE-2026-33816.md) | Urgent | golang-github-jackc-pgx-v5: Memory-safety vulnerability in github.com/jackc/pgx/v5. | 9.8 | 0.0058 | | | [CVE-2026-46595](https://patchblox.com/security/data/cve/CVE-2026-46595.md) | Urgent | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh | 10.0 | 0.0056 | | | [CVE-2026-42508](https://patchblox.com/security/data/cve/CVE-2026-42508.md) | High | Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts | 9.1 | 0.0691 | | | [CVE-2026-33186](https://patchblox.com/security/data/cve/CVE-2026-33186.md) | High | gRPC-Go has an authorization bypass via missing leading slash in :path | 9.1 | 0.0162 | | | [CVE-2026-33811](https://patchblox.com/security/data/cve/CVE-2026-33811.md) | High | Crash when handling long CNAME response in net | 8.8 | 0.0088 | | | [CVE-2026-25679](https://patchblox.com/security/data/cve/CVE-2026-25679.md) | High | Incorrect parsing of IPv6 host literals in net/url | 9.1 | 0.0083 | | | [CVE-2026-42154](https://patchblox.com/security/data/cve/CVE-2026-42154.md) | High | Prometheus: remote read endpoint allows denial of service via crafted snappy payload | 8.2 | 0.0081 | | | [CVE-2026-39830](https://patchblox.com/security/data/cve/CVE-2026-39830.md) | High | Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh | 9.1 | 0.0068 | | | [CVE-2026-39832](https://patchblox.com/security/data/cve/CVE-2026-39832.md) | High | Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent | 9.1 | 0.0068 | | | [CVE-2026-27137](https://patchblox.com/security/data/cve/CVE-2026-27137.md) | High | Incorrect enforcement of email constraints in crypto/x509 | 9.1 | 0.0066 | | | [CVE-2026-35469](https://patchblox.com/security/data/cve/CVE-2026-35469.md) | High | SpdyStream: DOS on CRI | 8.1 | 0.0066 | | | [CVE-2026-32283](https://patchblox.com/security/data/cve/CVE-2026-32283.md) | High | Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls | 9.1 | 0.0063 | | | [CVE-2026-32280](https://patchblox.com/security/data/cve/CVE-2026-32280.md) | High | Unexpected work during chain building in crypto/x509 | 9.1 | 0.0063 | | | [CVE-2026-39835](https://patchblox.com/security/data/cve/CVE-2026-39835.md) | High | Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh | 8.7 | 0.0050 | | | [CVE-2025-61729](https://patchblox.com/security/data/cve/CVE-2025-61729.md) | High | Excessive resource consumption when printing error string for host certificate validation in crypto/x509 | 8.1 | 0.0049 | | | [CVE-2026-39829](https://patchblox.com/security/data/cve/CVE-2026-39829.md) | High | Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh | 8.7 | 0.0047 | | | [CVE-2026-39828](https://patchblox.com/security/data/cve/CVE-2026-39828.md) | High | Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh | 8.8 | 0.0037 | | | [CVE-2026-32281](https://patchblox.com/security/data/cve/CVE-2026-32281.md) | High | Inefficient policy validation in crypto/x509 | 9.1 | 0.0036 | | | [CVE-2026-42151](https://patchblox.com/security/data/cve/CVE-2026-42151.md) | High | Prometheus Azure AD remote write OAuth client secret exposed via config API | 8.2 | 0.0035 | | | [CVE-2026-32282](https://patchblox.com/security/data/cve/CVE-2026-32282.md) | High | TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix | 9.1 | 0.0030 | | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo