| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: Name constraints for URI names were incorrectly acceptedCVE-2026-93600 · GHSA-965H-392X-2MH5Version ranges need review. |
rustls-webpkiConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicCVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| CRL Distribution Point Scope Check Logic Error in AWS-LCCVE-2026-4428 · GHSA-9F94-5G5W-GF6RVersion ranges need review. |
aws-lc-fips-sysaws-lc-sys |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| AWS-LC has Timing Side-Channel in AES-CCM Tag VerificationCVE-2026-3337 · GHSA-65P9-R9H6-22VJVersion ranges need review. |
aws-lc-fips-sysaws-lc-sys |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| time vulnerable to stack exhaustion Denial of Service attackCVE-2026-25727 · GHSA-R6V5-FH4H-64XCVersion ranges need review. |
timeConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181 · GHSA-PQ67-6M6Q-MJ2VVersion ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 does not control redirects in browsers and Node.jsCVE-2025-50182 · GHSA-48P4-8XCF-VXJ5Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File WriteCVE-2025-47273 · GHSA-5RJG-FVGR-3XXFVersion ranges need review. |
setuptoolsConfidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Some AES functions may panic when overflow checking is enabled in ringCVE-2025-4432 · GHSA-4P46-PWFR-66X6 |
ringRed Hat Enterprise Linux 10/firefox |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| crossbeam-channel Vulnerable to Double Free on DropCVE-2025-4574 · GHSA-PG9F-39PC-QF8GVersion ranges need review. |
crossbeam-channelRed Hat Enterprise Linux 10/389-ds-base |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| openssl: Timing side-channel in ECDSA signature computationCVE-2024-13176 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/fluentd-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8 |
Red Hat |
Low
|
No fix reported |
|
| rust-openssl: rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`CVE-2025-3416 |
Red Hat Directory Server 11/redhat-ds:11/389-ds-baseRed Hat Directory Server 12/redhat-ds:12/389-ds-base |
Red Hat |
Low
|
No fix reported |
|
| uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versionsCVE-2026-41988 |
Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9Confidential Cluster Operator/confidential-clusters-beta/buildroot-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()CVE-2026-75803 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| roxmltree: roxmltree: Denial of Service via Quadratic ParsingCVE-2026-92987 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/vector-rhel9Red Hat Trusted Artifact Signer/rhtas/tuffer-rhel9 |
Red Hat |
High
|
No fix reported |
|
| hex: hex: Denial of Service via unconstrained data decompressionCVE-2026-96618 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| hex: hex: Terminal output spoofing via unescaped control sequencesCVE-2026-81856 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
