Linux · Security advisory · August 13, 2026

RHSA-2026:68335: flightctl security update

RHSA-2026:68335, released August 13, 2026, fixes 11 CVEs in flightctl (version 1.2.1-1.el10). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0059
48th percentile

Priority of the 11 CVEs

Patch now 0 Urgent 0 High 11 Routine 0

Fixed package versions

ProductReleaseFixed in
flightctlRHEL 101.2.1-1.el10

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-27145 Inefficient candidate hostname parsing in crypto/x509 8.2 0.0059 None reported
High CVE-2026-33818 Enforce maximum recursion depth in encoding/asn1 8.8 0.0057 None reported
High CVE-2026-56853 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http 8.8 0.0057 None reported
High CVE-2026-56859 Add recursion depth guard during decode in encoding/xml 8.8 0.0057 None reported
High CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls 8.8 0.0057 None reported
High CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url 8.8 0.0055 None reported
High CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text 8.8 0.0048 None reported
High CVE-2026-44740 golang-github-go-git-go-billy-v6: Billy is an interface filesystem abstraction for Go 7.5 0.0039 None reported
High CVE-2026-71556 go-git: Worktree operations may follow symlinks 7.1 0.0036 None reported
High CVE-2026-41178 opentelemetry-collector: OpenTelemetry-Go is the Go implementation of OpenTelemetry 8.2 0.0034 None reported
High CVE-2026-56858 Fix Javascript regexp context tracking in html/template 8.8 0.0031 None reported
Showing 1 to 11 of 11 1