| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: Name constraints for URI names were incorrectly acceptedCVE-2026-93600 · GHSA-965H-392X-2MH5Version ranges need review. |
rustls-webpkiConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicCVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Apache Thrift Python, Go, PHP and Java bindings have an Infinite LoopCVE-2026-43871 · GHSA-8WV5-X4W7-5GWWVersion ranges need review. |
apache/thriftgithub.com/apache/thrift |
ComposerGoMavenPyPIRed Hat |
High
|
Fix reported |
|
| node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| actix-http has HTTP/1.1 CL.TE Request Smuggling CVE-2026-73051 · GHSA-XHJ4-VRGC-HR34 |
actix-httpRed Hat Enterprise Linux 10/keylime-agent-rust |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| tar-rs `unpack_in` can chmod arbitrary directories by following symlinksCVE-2026-33056 · GHSA-J4XF-2G29-59PHVersion ranges need review. |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| CRL Distribution Point Scope Check Logic Error in AWS-LCCVE-2026-4428 · GHSA-9F94-5G5W-GF6RVersion ranges need review. |
aws-lc-fips-sysaws-lc-sys |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| AWS-LC has Timing Side-Channel in AES-CCM Tag VerificationCVE-2026-3337 · GHSA-65P9-R9H6-22VJVersion ranges need review. |
aws-lc-fips-sysaws-lc-sys |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| time vulnerable to stack exhaustion Denial of Service attackCVE-2026-25727 · GHSA-R6V5-FH4H-64XCVersion ranges need review. |
timeConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| [actix-files] Panic triggered by empty Range header in GET request for static fileCVE-2026-72813 · GHSA-GCQF-3G44-VC9P |
actix-filesRed Hat OpenShift Update Service/openshift-update-service/openshift-update-service-rhel8 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| actix-files has a possible exposure of information vulnerabilityCVE-2026-72814 · GHSA-8V2V-WJWG-VX6R |
actix-filesRed Hat OpenShift Update Service/openshift-update-service/openshift-update-service-rhel8 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| rsa crate has potential panic on a prime being equal to 1CVE-2026-21895 · GHSA-9C48-W39G-HM26 |
rsaConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| escargot: Escargot: Denial of Service due to integer overflow or wraparound vulnerabilityCVE-2026-40447 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red Hat |
Medium
|
No fix reported |
|
| uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versionsCVE-2026-41988 |
Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9Confidential Cluster Operator/confidential-clusters-beta/buildroot-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted fileCVE-2026-42250 |
Confidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-payload-rhel9OpenShift Lightspeed/openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| org.hdrhistogram/HdrHistogram: HdrHistogram: HdrHistogram: Denial of Service via uncontrolled memory allocation in decodeFromByteBufferCVE-2026-14684 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/vector-rhel9OpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| quay: SSRF in Red Hat Quay notification webhooks (Slack/generic)CVE-2026-16910 |
Red Hat OpenShift Update Service/openshift-update-service/openshift-update-service-rhel8Red Hat Quay 3/quay/quay-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparoundCVE-2026-55969 |
Confidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-payload-rhel9Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9 |
Red Hat |
High
|
No fix reported |
|
