Issued:: 2026-08-13
Updated:: 2026-08-13

RHSA-2026:54757 - Important: Red Hat OpenStack Platform 16.2 security advisory

Synopsis

Important: Red Hat OpenStack Platform 16.2 security advisory

Type/Severity

Security Advisory: Important

Topic

An update for Red Hat OpenStack Platform 16.2 (Train) is now available.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.

Security Fix(es):

crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova (CVE-2026-24708)
pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)
golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)
openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access (CVE-2026-34881)
crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
etcd: etcd: Authorization bypass allows information disclosure and denial of service (CVE-2026-33413)
crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation (CVE-2026-42789)
crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
oslo.messaging: openstack: OpenStack oslo.messaging: Man-in-the-middle attack via improper TLS hostname verification (CVE-2026-44393)
erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing (CVE-2026-42790)
openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw (CVE-2025-65073)
OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation (CVE-2026-43001)
openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation (CVE-2026-33551)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

Product	Version	Arch
Red Hat OpenStack	16.2	x86_64
Red Hat OpenStack for IBM Power	16.2	ppc64le
Red Hat OpenStack Director Deployment Tools	16.2	x86_64
Red Hat OpenStack Director Deployment Tools for IBM Power LE	16.2	ppc64le
Red Hat Enterprise Linux for x86_64	8	x86_64
Cinderlib	16.2	x86_64
Cinderlib for IBM Power LE	16.2	ppc64le

Updated Packages

etcd-debugsource-3.3.23-22.el8ost.ppc64le.rpm
erlang-debuginfo-23.3.4.18-2.el8ost.ppc64le.rpm
puppet-vcsrepo-3.0.1-2.20250728140014.b06d5d3.el8ost.noarch.rpm
python3-tempest-tests-26.1.0-2.20250728145114.271f820.el8ost.noarch.rpm
erlang-hipe-23.3.4.18-2.el8ost.x86_64.rpm
erlang-os_mon-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-ssl-23.3.4.18-2.el8ost.x86_64.rpm
erlang-parsetools-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-erts-debuginfo-23.3.4.18-2.el8ost.x86_64.rpm
openstack-tripleo-heat-templates-11.6.1-2.20251125134914.9adcac6.el8ost.noarch.rpm
collectd-sensubility-0.2.1-1.1.el8ost.src.rpm
erlang-runtime_tools-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-public_key-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-stdlib-23.3.4.18-2.el8ost.x86_64.rpm
openstack-cinder-15.6.1-2.20250708154832.299553a.el8ost.src.rpm
erlang-debugsource-23.3.4.18-2.el8ost.x86_64.rpm
puppet-haproxy-4.1.1-2.20250728141134.df96ffc.el8ost.src.rpm
puppet-java-5.0.2-2.20250804144904.e57cbc8.el8ost.noarch.rpm
puppet-remote-10.0.0-2.20250728135533.7420908.el8ost.noarch.rpm
puppet-tomcat-3.1.1-2.20250804144904.a3f92d1.el8ost.src.rpm
erlang-kernel-23.3.4.18-2.el8ost.ppc64le.rpm
openstack-nova-common-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
erlang-asn1-debuginfo-23.3.4.18-2.el8ost.ppc64le.rpm
openstack-nova-compute-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
puppet-stdlib-6.1.1-2.20250728131928.5aa891c.el8ost.src.rpm
openstack-cinder-15.6.1-2.20250708154832.299553a.el8ost.noarch.rpm
openstack-tripleo-common-11.7.1-2.20251029134905.e189622.el8ost.noarch.rpm
puppet-inifile-3.1.1-2.20250728133040.91efced.el8ost.src.rpm
erlang-erl_interface-debuginfo-23.3.4.18-2.el8ost.x86_64.rpm
erlang-public_key-23.3.4.18-2.el8ost.x86_64.rpm
erlang-snmp-23.3.4.18-2.el8ost.ppc64le.rpm
puppet-module-data-0.5.1-2.20250728142646.28dafce.el8ost.noarch.rpm
erlang-23.3.4.18-2.el8ost.src.rpm
erlang-stdlib-23.3.4.18-2.el8ost.ppc64le.rpm
openstack-nova-serialproxy-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
openstack-tripleo-common-11.7.1-2.20251029134905.e189622.el8ost.src.rpm
puppet-rabbitmq-10.1.2-2.20250728144344.8b9b006.el8ost.noarch.rpm
puppet-xinetd-3.3.1-2.20250728135145.d768da2.el8ost.src.rpm
erlang-asn1-23.3.4.18-2.el8ost.x86_64.rpm
python3-pyasn1-0.4.6-4.el8ost.noarch.rpm
python3-pyasn1-modules-0.4.6-4.el8ost.noarch.rpm
puppet-tomcat-3.1.1-2.20250804144904.a3f92d1.el8ost.noarch.rpm
erlang-asn1-debuginfo-23.3.4.18-2.el8ost.x86_64.rpm
puppet-apache-5.1.1-2.20250728133931.1fa9b1c.el8ost.src.rpm
python3-tempest-26.1.0-2.20250728145114.271f820.el8ost.noarch.rpm
openstack-keystone-16.0.3-2.20260616134936.9d699a7.el8ost.src.rpm
etcd-3.3.23-22.el8ost.x86_64.rpm
python3-nova-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
etcd-3.3.23-22.el8ost.ppc64le.rpm
puppet-datacat-0.6.3-2.20250728140400.5cce8f2.el8ost.src.rpm
puppet-vcsrepo-3.0.1-2.20250728140014.b06d5d3.el8ost.src.rpm
openstack-tripleo-common-containers-11.7.1-2.20251029134905.e189622.el8ost.noarch.rpm
erlang-snmp-23.3.4.18-2.el8ost.x86_64.rpm
openstack-tripleo-common-container-base-11.7.1-2.20251029134905.e189622.el8ost.noarch.rpm
erlang-runtime_tools-23.3.4.18-2.el8ost.x86_64.rpm
collectd-sensubility-0.2.1-1.1.el8ost.x86_64.rpm
erlang-erl_interface-debuginfo-23.3.4.18-2.el8ost.ppc64le.rpm
etcd-3.3.23-22.el8ost.src.rpm
erlang-asn1-23.3.4.18-2.el8ost.ppc64le.rpm
openstack-nova-migration-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
collectd-sensubility-debuginfo-0.2.1-1.1.el8ost.x86_64.rpm
erlang-inets-23.3.4.18-2.el8ost.x86_64.rpm
puppet-xinetd-3.3.1-2.20250728135145.d768da2.el8ost.noarch.rpm
python3-keystone-16.0.3-2.20260616134936.9d699a7.el8ost.noarch.rpm
openstack-nova-spicehtml5proxy-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
openstack-tripleo-heat-templates-11.6.1-2.20251125134914.9adcac6.el8ost.src.rpm
erlang-parsetools-23.3.4.18-2.el8ost.x86_64.rpm
openstack-nova-api-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
openstack-tempest-all-26.1.0-2.20250728145114.271f820.el8ost.noarch.rpm
erlang-tools-debuginfo-23.3.4.18-2.el8ost.x86_64.rpm
erlang-mnesia-23.3.4.18-2.el8ost.ppc64le.rpm
python-collectd-gnocchi-1.7.2-2.20250728143604.de115a7.el8ost.src.rpm
puppet-git-0.5.0-2.20250728140843.4e4498e.el8ost.noarch.rpm
python3-collectd-gnocchi-1.7.2-2.20250728143604.de115a7.el8ost.noarch.rpm
tripleo-ansible-0.8.1-2.20260112154909.123ce73.el8ost.src.rpm
erlang-tools-23.3.4.18-2.el8ost.x86_64.rpm
python3-oslo-messaging-10.2.4-2.20260710155333.82281a0.el8ost.noarch.rpm
python3-cinder-15.6.1-2.20250708154832.299553a.el8ost.noarch.rpm
openstack-nova-console-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
erlang-crypto-23.3.4.18-2.el8ost.x86_64.rpm
python3-gnocchiclient-7.0.4-2.20250728131928.64814b9.el8ost.noarch.rpm
erlang-compiler-23.3.4.18-2.el8ost.x86_64.rpm
openstack-nova-20.6.2-2.20260317135026.8a24acd.el8ost.src.rpm
puppet-concat-6.1.1-2.20250728133127.9baa8fc.el8ost.noarch.rpm
python-pyasn1-0.4.6-4.el8ost.src.rpm
erlang-os_mon-23.3.4.18-2.el8ost.x86_64.rpm
puppet-staging-1.0.5-2.20250728134218.b466d93.el8ost.noarch.rpm
puppet-rabbitmq-10.1.2-2.20250728144344.8b9b006.el8ost.src.rpm
erlang-debugsource-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-xmerl-23.3.4.18-2.el8ost.ppc64le.rpm
puppet-firewall-3.4.1-2.20250728144450.94f707c.el8ost.src.rpm
erlang-crypto-23.3.4.18-2.el8ost.ppc64le.rpm
puppet-inifile-3.1.1-2.20250728133040.91efced.el8ost.noarch.rpm
collectd-sensubility-0.2.1-1.1.el8ost.ppc64le.rpm
erlang-crypto-debuginfo-23.3.4.18-2.el8ost.x86_64.rpm
erlang-ssl-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-kernel-23.3.4.18-2.el8ost.x86_64.rpm
puppet-apache-5.1.1-2.20250728133931.1fa9b1c.el8ost.noarch.rpm
puppet-staging-1.0.5-2.20250728134218.b466d93.el8ost.src.rpm
puppet-module-data-0.5.1-2.20250728142646.28dafce.el8ost.src.rpm
python-oslo-messaging-10.2.4-2.20260710155333.82281a0.el8ost.src.rpm
erlang-syntax_tools-23.3.4.18-2.el8ost.x86_64.rpm
puppet-firewall-3.4.1-2.20250728144450.94f707c.el8ost.noarch.rpm
puppet-keepalived-0.0.2-2.20250728142002.bbca37a.el8ost.noarch.rpm
erlang-syntax_tools-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-sasl-23.3.4.18-2.el8ost.ppc64le.rpm
puppet-git-0.5.0-2.20250728140843.4e4498e.el8ost.src.rpm
collectd-sensubility-debuginfo-0.2.1-1.1.el8ost.ppc64le.rpm
erlang-eldap-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-odbc-debuginfo-23.3.4.18-2.el8ost.ppc64le.rpm
openstack-nova-scheduler-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
openstack-swift-object-2.23.4-2.20260121154927.70b68db.el8ost.noarch.rpm
puppet-stdlib-6.1.1-2.20250728131928.5aa891c.el8ost.noarch.rpm
openstack-keystone-16.0.3-2.20260616134936.9d699a7.el8ost.noarch.rpm
openstack-nova-novncproxy-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
puppet-ipaclient-2.5.2-2.20250728141812.b086731.el8ost.src.rpm
erlang-erts-debuginfo-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-erts-23.3.4.18-2.el8ost.ppc64le.rpm
puppet-java-5.0.2-2.20250804144904.e57cbc8.el8ost.src.rpm
python3-tripleo-common-11.7.1-2.20251029134905.e189622.el8ost.noarch.rpm
etcd-debuginfo-3.3.23-22.el8ost.x86_64.rpm
puppet-snmp-3.9.1-2.20250728142735.5d73485.el8ost.noarch.rpm
puppet-snmp-3.9.1-2.20250728142735.5d73485.el8ost.src.rpm
openstack-swift-2.23.4-2.20260121154927.70b68db.el8ost.src.rpm
erlang-eldap-23.3.4.18-2.el8ost.x86_64.rpm
erlang-runtime_tools-debuginfo-23.3.4.18-2.el8ost.x86_64.rpm
puppet-keepalived-0.0.2-2.20250728142002.bbca37a.el8ost.src.rpm
openstack-swift-account-2.23.4-2.20260121154927.70b68db.el8ost.noarch.rpm
openstack-swift-container-2.23.4-2.20260121154927.70b68db.el8ost.noarch.rpm
erlang-debuginfo-23.3.4.18-2.el8ost.x86_64.rpm
erlang-tools-debuginfo-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-mnesia-23.3.4.18-2.el8ost.x86_64.rpm
erlang-erts-23.3.4.18-2.el8ost.x86_64.rpm
erlang-tools-23.3.4.18-2.el8ost.ppc64le.rpm
puppet-corosync-6.0.2-2.20250728134759.961add3.el8ost.noarch.rpm
erlang-os_mon-debuginfo-23.3.4.18-2.el8ost.x86_64.rpm
erlang-os_mon-debuginfo-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-compiler-23.3.4.18-2.el8ost.ppc64le.rpm
erlang-xmerl-23.3.4.18-2.el8ost.x86_64.rpm
erlang-hipe-23.3.4.18-2.el8ost.ppc64le.rpm
etcd-debugsource-3.3.23-22.el8ost.x86_64.rpm
puppet-corosync-6.0.2-2.20250728134759.961add3.el8ost.src.rpm
openstack-nova-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
puppet-haproxy-4.1.1-2.20250728141134.df96ffc.el8ost.noarch.rpm
erlang-runtime_tools-debuginfo-23.3.4.18-2.el8ost.ppc64le.rpm
python-gnocchiclient-7.0.4-2.20250728131928.64814b9.el8ost.src.rpm
python3-glance-19.0.5-2.20260512165254.eb6ad61.el8ost.noarch.rpm
openstack-tempest-26.1.0-2.20250728145114.271f820.el8ost.src.rpm
puppet-ipaclient-2.5.2-2.20250728141812.b086731.el8ost.noarch.rpm
erlang-inets-23.3.4.18-2.el8ost.ppc64le.rpm
puppet-concat-6.1.1-2.20250728133127.9baa8fc.el8ost.src.rpm
openstack-glance-19.0.5-2.20260512165254.eb6ad61.el8ost.src.rpm
python3-swift-2.23.4-2.20260121154927.70b68db.el8ost.noarch.rpm
openstack-tempest-26.1.0-2.20250728145114.271f820.el8ost.noarch.rpm
tripleo-ansible-0.8.1-2.20260112154909.123ce73.el8ost.noarch.rpm
erlang-odbc-debuginfo-23.3.4.18-2.el8ost.x86_64.rpm
etcd-debuginfo-3.3.23-22.el8ost.ppc64le.rpm
openstack-nova-conductor-20.6.2-2.20260317135026.8a24acd.el8ost.noarch.rpm
puppet-datacat-0.6.3-2.20250728140400.5cce8f2.el8ost.noarch.rpm
erlang-sasl-23.3.4.18-2.el8ost.x86_64.rpm
openstack-swift-proxy-2.23.4-2.20260121154927.70b68db.el8ost.noarch.rpm
erlang-crypto-debuginfo-23.3.4.18-2.el8ost.ppc64le.rpm
openstack-tripleo-common-devtools-11.7.1-2.20251029134905.e189622.el8ost.noarch.rpm
openstack-glance-19.0.5-2.20260512165254.eb6ad61.el8ost.noarch.rpm
puppet-remote-10.0.0-2.20250728135533.7420908.el8ost.src.rpm

Fixes

CVEs

References

https://access.redhat.com/security/updates/classification/#important

Additional information

The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at Security Contacts and Procedures.
Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.