CVE-2026-42508

CriticalCVSS 9.1/10Last modified Sep 15, 2026

Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

VendorProductVersions
golang.org/x/cryptogolang.org/x/crypto/ssh/knownhosts< 0.52.0
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRHEM 1.0 for RHEL 9—
Red HatRHEM 1.1 for RHEL 10—
Red HatRHEM 1.1 for RHEL 9—
Red HatCluster Observability Operator 1.5.0—
Red HatDevWorkspace Operator 0.42—
Red HatLogging Subsystem for Red Hat OpenShift 6.6—
Red Hatmulticluster engine for Kubernetes 2.1—
Red Hatmulticluster engine for Kubernetes 2.11—
Red Hatmulticluster engine for Kubernetes 2.11—
Red Hatmulticluster engine for Kubernetes 2.8—
Red HatOpenShift API for Data Protection 1.3—
Red HatOpenShift API for Data Protection 1.4—
Red HatOpenShift API for Data Protection 1.5—
Red HatOpenShift API for Data Protection 1.6—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.11—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—
Red HatRed Hat Advanced Cluster Security 4.9—
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.10—
Red HatRed Hat Edge Manager 1.0—
Red HatRed Hat Edge Manager 1.1—
Red HatRed Hat Edge Manager 1.1—
Red HatRed Hat Hardened Images—
Red HatRed Hat Hardened Images—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift Builds 1.7.3—
Red HatRed Hat OpenShift Builds 1.8.1—
Red HatRed Hat OpenShift Builds 1.8.1—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—

References

Timeline

Published
May 22, 2026
Last modified
Sep 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-425096.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects ApaCVE-2026-42512.5A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of tCVE-2026-425107.2OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.CVE-2026-425118.1The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf dirCVE-2026-425128.1As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expanCVE-2026-425138.8This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authCVE-2026-425148.8This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulneCVE-2026-425157.1This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploitCVE-2026-425167.1This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit CVE-2026-425177.1This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attackerCVE-2026-425188.7This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScripCVE-2026-425194.3A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission t
CVE-2026-42508: Critical severity, CVSS 9.1 | Vulnix