| Enforce maximum recursion depth in encoding/asn1CVE-2026-33818 · GO-2026-5972 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct FieldsCVE-2026-77407 · GHSA-27GV-RFVV-22MVVersion ranges need review. |
github.com/rabbitmq/amqp091-goCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer OverflowCVE-2026-77408 · GHSA-J497-X9HR-X34XVersion ranges need review. |
github.com/rabbitmq/amqp091-goCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| HTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325 · GHSA-4374-P667-P6C8Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensCVE-2026-48978 · GHSA-XF85-363P-868WVersion ranges need review. |
oras.land/oras-go/v2oras.land/oras-go |
GoRed Hat |
Low
|
Fix reported |
|
| oras-go blob upload vulnerable to credential forwarding via unvalidated Location headerCVE-2026-50151 · GHSA-JXPM-75MH-9FP7Version ranges need review. |
oras.land/oras-go/v2OpenShift Service Mesh 3/openshift-service-mesh/istio-rhel9-operator |
GoRed Hat |
High
|
Fix reported |
|
| `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolutionCVE-2026-50163 · GHSA-FXHP-MV3V-67QPVersion ranges need review. |
oras.land/oras-go/v2Gatekeeper 3/gatekeeper/gatekeeper-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Docker: Race condition in docker cp allows bind mount redirection to host pathCVE-2026-42306 · GHSA-RG2X-37C3-W2RHVersion ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
High
|
Fix reported |
|
| Go Net HTML parser is vulnerable to denial of serviceCVE-2026-25680 · GHSA-5CV4-JP36-H3MWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytesCVE-2025-10543 · GHSA-32FW-GQ77-F2F2Version ranges need review. |
github.com/eclipse/paho.mqtt.golangRed Hat Enterprise Linux 10/rhel10/rhel-bootc |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net vulnerable to Cross-site ScriptingCVE-2025-22872 · GHSA-VVGC-356P-C3XWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870 · GHSA-QXP5-GWG8-XV66Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Infinite parsing loop in golang.org/x/netCVE-2025-58190 · GO-2026-4441 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| cert-manager-controller DoS via Specially Crafted DNS ResponseCVE-2026-25518 · GHSA-GX3X-VQ4P-MHHVVersion ranges need review. |
github.com/cert-manager/cert-managerCryostat 4/cryostat/cryostat-rhel9-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Sensitive headers incorrectly sent after cross-domain redirect in net/httpCVE-2024-45336 · GO-2025-3420 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Insufficient sanitization of Host header in net/httpCVE-2023-29406 · GO-2023-1878 |
stdlibMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-rhv-populator-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
