Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Ignition packages may crash or become slow
published 1 month ago
Summary
Several AlmaLinux Ignition components (including ignition, ignition‑edge, ignition‑grub, and ignition‑validate) contain coding errors that can cause the software to run very slowly, run out of memory, or stop working when handling certain email, web or data inputs. This can affect any system that uses these packages, potentially leading to service disruptions. Updating the packages to the latest version that includes the corrected Go language libraries resolves the issue.
What to do
- Update almalinux ignition to version 2.21.0-1.el9_6.tuxcare.els2.
- Update almalinux ignition-edge to version 2.21.0-1.el9_6.tuxcare.els2.
- Update almalinux ignition-grub to version 2.21.0-1.el9_6.tuxcare.els2.
- Update almalinux ignition-validate to version 2.21.0-1.el9_6.tuxcare.els2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | ignition |
< 2.21.0-1.el9_6.tuxcare.els2 Fix: upgrade to 2.21.0-1.el9_6.tuxcare.els2
|
| TuxCare:AlmaLinux:9.6 | almalinux | ignition-edge |
< 2.21.0-1.el9_6.tuxcare.els2 Fix: upgrade to 2.21.0-1.el9_6.tuxcare.els2
|
| TuxCare:AlmaLinux:9.6 | almalinux | ignition-grub |
< 2.21.0-1.el9_6.tuxcare.els2 Fix: upgrade to 2.21.0-1.el9_6.tuxcare.els2
|
| TuxCare:AlmaLinux:9.6 | almalinux | ignition-validate |
< 2.21.0-1.el9_6.tuxcare.els2 Fix: upgrade to 2.21.0-1.el9_6.tuxcare.els2
|
Original advisory text
ignition: Fix of 8 CVEs
- CVE-2026-39820: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
quadratic complexity in consumeComment in net/mail, where repeated string
concatenation made nested comment depth O(n^2)
- CVE-2026-42499: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
quadratic consumePhrase behavior in net/mail, which repeatedly concatenated
encoded-word runs into the previous slice element
- CVE-2026-33818: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
stack exhaustion in encoding/asn1 Unmarshal when parsing deeply-nested
recursive structures
- CVE-2026-56853: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to apply
ReadHeaderTimeout to the server's unencrypted HTTP/2 client preface read, and
clear the connection timeouts once the connection is handed off to http2
- CVE-2026-56858: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
JavaScript regexp context tracking in html/template, where pathological input
could close an unescaped '/' early and inject attacker-controlled content
- CVE-2026-56859: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
stack exhaustion in encoding/xml, where DecodeElement reset the recursion
depth counter
- CVE-2026-56860: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
quadratic complexity in net/url resolvePath when resolving '..' segments
- CVE-2026-56862: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
unbounded key derivation work in crypto/tls, where handshake messages still
counted as state-advancing after the handshake completed
quadratic complexity in consumeComment in net/mail, where repeated string
concatenation made nested comment depth O(n^2)
- CVE-2026-42499: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
quadratic consumePhrase behavior in net/mail, which repeatedly concatenated
encoded-word runs into the previous slice element
- CVE-2026-33818: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
stack exhaustion in encoding/asn1 Unmarshal when parsing deeply-nested
recursive structures
- CVE-2026-56853: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to apply
ReadHeaderTimeout to the server's unencrypted HTTP/2 client preface read, and
clear the connection timeouts once the connection is handed off to http2
- CVE-2026-56858: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
JavaScript regexp context tracking in html/template, where pathological input
could close an unescaped '/' early and inject attacker-controlled content
- CVE-2026-56859: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
stack exhaustion in encoding/xml, where DecodeElement reset the recursion
depth counter
- CVE-2026-56860: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
quadratic complexity in net/url resolvePath when resolving '..' segments
- CVE-2026-56862: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix
unbounded key derivation work in crypto/tls, where handshake messages still
counted as state-advancing after the handshake completed
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789469873.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33818 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39820 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42499 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56853 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56858 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56859 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56860 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56862 Vendor Advisory
Timeline
Published15 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1789469873 · OSV
Track software like this
Free during beta