| Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsCVE-2026-118264 · GHSA-CXF3-9H37-7RR8Version ranges need review. |
github.com/labstack/echo/v4github.com/labstack/echo/v5 |
GoRed Hat |
Critical
|
Fix reported |
|
| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| Enforce maximum recursion depth in encoding/asn1CVE-2026-33818 · GO-2026-5972 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationCVE-2026-77410 · GHSA-R9C8-GCJP-XFWHVersion ranges need review. |
github.com/rabbitmq/amqp091-goCustom Metric Autoscaler operator for Red Hat Openshift/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct FieldsCVE-2026-77407 · GHSA-27GV-RFVV-22MVVersion ranges need review. |
github.com/rabbitmq/amqp091-goCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter InjectionCVE-2026-77404 · GHSA-465G-FH3V-9JW4Version ranges need review. |
github.com/rabbitmq/amqp091-goMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos ConfigurationCVE-2026-77406 · GHSA-RM6M-HRCW-JW33Version ranges need review. |
github.com/rabbitmq/amqp091-goMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81872 · GHSA-HJF4-FPHR-2H65Version ranges need review. |
go.opentelemetry.io/otel/sdk/logAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP ClientCVE-2026-77412 · GHSA-4V58-74MF-RJX3Version ranges need review. |
github.com/rabbitmq/amqp091-goMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer OverflowCVE-2026-77408 · GHSA-J497-X9HR-X34XVersion ranges need review. |
github.com/rabbitmq/amqp091-goCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size NegotiationCVE-2026-77403 · GHSA-XWWF-M8FG-P9Q2Version ranges need review. |
github.com/rabbitmq/amqp091-goCustom Metric Autoscaler operator for Red Hat Openshift/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that userCVE-2026-61709 · GHSA-G3PG-FRFM-PR2MVersion ranges need review. |
github.com/openfga/openfgaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana: Path traversal in the Tempo and Loki data source pluginsCVE-2026-10601 · GHSA-9493-H4F5-633XVersion ranges need review. |
github.com/grafana/grafanaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81871 · GHSA-W34Q-CM8F-9C5XVersion ranges need review. |
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Excessive memory allocation when decoding malicious SFNT in golang.org/x/imageCVE-2026-33812 · GO-2026-4962 |
golang.org/x/imageCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlCVE-2026-27136 · GO-2026-5030 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoSCVE-2026-39827 · GHSA-QPW4-5X99-6VJPVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
