| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: Name constraints for URI names were incorrectly acceptedCVE-2026-93600 · GHSA-965H-392X-2MH5Version ranges need review. |
rustls-webpkiConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicCVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingCVE-2026-31812 · GHSA-6XVM-J4WR-6V98Version ranges need review. |
quinn-protoConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| jsonwebtoken has Type Confusion that leads to potential authorization bypassCVE-2026-25537 · GHSA-H395-GR6Q-CPJC |
jsonwebtokenConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| time vulnerable to stack exhaustion Denial of Service attackCVE-2026-25727 · GHSA-R6V5-FH4H-64XCVersion ranges need review. |
timeConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| rsa crate has potential panic on a prime being equal to 1CVE-2026-21895 · GHSA-9C48-W39G-HM26 |
rsaConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| curl: libssh key passphrase bypass without agent setCVE-2025-15224 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| curl: Host verification bypass during SSH transfersCVE-2025-15079 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| curl: libcurl: Improper certificate validation due to cached TLS settings reuseCVE-2025-14819 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| curl: Information disclosure via cross-protocol redirect with OAuth2 bearer tokenCVE-2025-14524 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonationCVE-2025-13034 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfersCVE-2025-14017 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authenticationCVE-2026-1965 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirectCVE-2026-3783 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| curl: curl: Unauthorized access due to improper HTTP proxy connection reuseCVE-2026-3784 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handlingCVE-2026-3805 |
Confidential Compute Attestation/build-of-trustee/trustee-rhel9Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
