CVE-2026-32952

medium Red Hat
CVSS v3 Base Score
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.1%
Exploitation probability in 30 days
Top 79% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Published: April 24, 2026 (77 days ago)
Last Modified: April 24, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in the `go-ntlmssp` package. A remote attacker could exploit this vulnerability by sending a specially crafted NTLM (NT LAN Manager) challenge message. This malicious message can trigger a slice out of bounds panic, leading to a Denial of Service (DoS) by crashing any Go process that utilizes `ntlmssp.Negotiator` for HTTP transport.

CWE

CWE-190

Affected Products

Assisted Installer for Red Hat OpenShift Container Platform 2cert-manager Operator for Red Hat OpenShiftConfidential Compute AttestationExternal Secrets Operator for Red Hat OpenShiftKernel Module Management Operator for Red Hat OpenshiftLogging Subsystem for Red Hat OpenShiftLogical Volume Manager StorageMigration Toolkit for ContainersMigration Toolkit for VirtualizationMulticluster Engine for Kubernetes

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com 🔗 github.com