Linux · Security advisory · May 22, 2026
RHSA-2026:41019: flightctl security update
RHSA-2026:41019, released May 22, 2026, fixes 22 CVEs in flightctl (version 1.1.3-1.el10em). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
22
4 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0691
94th percentile
Priority of the 22 CVEs
Patch now 0
Urgent 4
High 18
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| flightctl | RHEL 10 | 1.1.3-1.el10em |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | 10.0 | 0.0183 | None reported | |
| Urgent | CVE-2026-33815 | golang-github-jackc-pgx-v5: Memory-safety vulnerability in github.com/jackc/pgx/v5. | 9.8 | 0.0063 | None reported | |
| Urgent | CVE-2026-33816 | golang-github-jackc-pgx-v5: Memory-safety vulnerability in github.com/jackc/pgx/v5. | 9.8 | 0.0058 | None reported | |
| Urgent | CVE-2026-46595 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh | 10.0 | 0.0056 | None reported | |
| High | CVE-2026-42508 | Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts | 9.1 | 0.0691 | None reported | |
| High | CVE-2026-33186 | gRPC-Go has an authorization bypass via missing leading slash in :path | 9.1 | 0.0162 | None reported | |
| High | CVE-2026-33811 | Crash when handling long CNAME response in net | 8.8 | 0.0088 | None reported | |
| High | CVE-2026-25679 | Incorrect parsing of IPv6 host literals in net/url | 9.1 | 0.0083 | None reported | |
| High | CVE-2026-42154 | Prometheus: remote read endpoint allows denial of service via crafted snappy payload | 8.2 | 0.0081 | None reported | |
| High | CVE-2026-39830 | Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh | 9.1 | 0.0068 | None reported | |
| High | CVE-2026-39832 | Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent | 9.1 | 0.0068 | None reported | |
| High | CVE-2026-27137 | Incorrect enforcement of email constraints in crypto/x509 | 9.1 | 0.0066 | None reported | |
| High | CVE-2026-35469 | SpdyStream: DOS on CRI | 8.1 | 0.0066 | None reported | |
| High | CVE-2026-32283 | Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls | 9.1 | 0.0063 | None reported | |
| High | CVE-2026-32280 | Unexpected work during chain building in crypto/x509 | 9.1 | 0.0063 | None reported | |
| High | CVE-2026-39835 | Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh | 8.7 | 0.0050 | None reported | |
| High | CVE-2025-61729 | Excessive resource consumption when printing error string for host certificate validation in crypto/x509 | 8.1 | 0.0049 | None reported | |
| High | CVE-2026-39829 | Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh | 8.7 | 0.0047 | None reported | |
| High | CVE-2026-39828 | Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh | 8.8 | 0.0037 | None reported | |
| High | CVE-2026-32281 | Inefficient policy validation in crypto/x509 | 9.1 | 0.0036 | None reported | |
| High | CVE-2026-42151 | Prometheus Azure AD remote write OAuth client secret exposed via config API | 8.2 | 0.0035 | None reported | |
| High | CVE-2026-32282 | TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix | 9.1 | 0.0030 | None reported |
Showing 1 to 22 of 22
1