Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0.18 (golang-github-openstack-k8s-operators-os-diff) security update

Fixed packages 1

Vulnerabilities 2

• Critical 9.1
  CVE-2025-68121

  Unexpected session resumption in crypto/tls

  During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

  Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 5, 2026
• High 7.5
  CVE-2025-65637 Public exploit

  Logrus is vulnerable to DoS when using Entry.Writer()

  A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" a…

  kube-fluentd-operator cri-o podman kubeflow-profile-controller Debian Ubuntu Azure Linux Wolfi Go
  Dec 4, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418900
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2437111
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7885.json
• report
  https://access.redhat.com/security/cve/CVE-2025-65637
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-65637
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-65637
• article
  https://github.com/mjuanxd/logrus-dos-poc
• article
  https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md
• article
  https://github.com/sirupsen/logrus/issues/1370
• article
  https://github.com/sirupsen/logrus/pull/1376
• article
  https://github.com/sirupsen/logrus/releases/tag/v1.8.3
• article
  https://github.com/sirupsen/logrus/releases/tag/v1.9.1
• article
  https://github.com/sirupsen/logrus/releases/tag/v1.9.3
• article
  https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391
• report
  https://access.redhat.com/security/cve/CVE-2025-68121
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68121
• article
  https://go.dev/cl/737700
• article
  https://go.dev/issue/77217
• article
  https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
• advisory
  https://pkg.go.dev/vuln/GO-2026-4337