Improper Certificate Validation The advisory has been revoked - it doesn't affect any version of package openshift-prometheus-promu (opens in a new tab)

Threat Intelligence

0.14% (4^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL10-OPENSHIFTPROMETHEUSPROMU-21345237
published21 Oct 2026
disclosed20 Oct 2026

Report a new vulnerability Found a mistake?

Introduced: 20 Oct 2026

NewCVE-2026-111943 (opens in a new tab) CWE-295 (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openshift-prometheus-promu package and not the openshift-prometheus-promu package as distributed by RHEL.

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.