| Enforce maximum recursion depth in encoding/asn1CVE-2026-33818 · GO-2026-5972 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLCVE-2026-55797 · GHSA-J6CW-G6P4-7HCHVersion ranges need review. |
github.com/argoproj/argo-cd/v2github.com/argoproj/argo-cd/v3 |
GoRed Hat |
High
|
Fix reported |
|
| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Prevent DoS on deadlocked established channel in golang.org/x/crypto/sshCVE-2026-56855 · GO-2026-6355 |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| oras-go has file store write outside workingDir via symlink traversalCVE-2026-50162 · GHSA-8XWF-RJM4-XVHVVersion ranges need review. |
oras.land/oras-go/v2Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557 · GHSA-QGQ7-7HM3-Q39JVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCECVE-2026-44477 · GHSA-423P-G724-FR39Version ranges need review. |
github.com/cloudnative-pg/cloudnative-pgRed Hat Openshift Data Foundation 4/odf4/ocs-metrics-exporter-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Logrus is vulnerable to DoS when using Entry.Writer()CVE-2025-65637 · GHSA-4F99-4Q7P-P3GHVersion ranges need review. |
github.com/sirupsen/logrusConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Supplementary groups are not set up properly in github.com/containerd/containerdCVE-2023-25173 · GHSA-HMFX-3PCX-653PVersion ranges need review. |
github.com/containerd/containerdCryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| YAML Go package vulnerable to denial of serviceCVE-2021-4235 · GHSA-R88R-GMRH-7J83Version ranges need review. |
github.com/go-yaml/yamlgopkg.in/yaml.v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metricsCVE-2023-45142 · GHSA-RCJV-MGP8-QVMRVersion ranges need review. |
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestfulgo.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin |
GoRed Hat |
High
|
Fix reported |
|
| Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/sshCVE-2026-78662 · GO-2026-6354 |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience ClaimsCVE-2024-5798 · GHSA-32CJ-5WX4-GQ8PVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| goproxy Denial of Service vulnerabilityCVE-2023-37788 · GHSA-4R8X-2P26-976PVersion ranges need review. |
github.com/elazarl/goproxyLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| HashiCorp Vault Improper Input Validation vulnerabilityCVE-2023-4680 · GHSA-V84F-6R39-CPFCVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Consul Server Panic when Ingress and API Gateways Configured with Peering ConnectionsCVE-2023-0845 · GHSA-WJ6X-HCC2-F32JVersion ranges need review. |
github.com/hashicorp/consulRed Hat Openshift Data Foundation 4/odf4/odf-multicluster-rhel9-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionCVE-2026-42880 · GHSA-3V3M-WC6V-X4X3 |
github.com/argoproj/argo-cd/v3Red Hat Openshift Data Foundation 4/odf4/odf-multicluster-rhel9-operator |
GoRed Hat |
Critical
|
Fix reported |
|
| HashiCorp Vault vulnerable to incorrect metadata accessCVE-2022-40186 · GHSA-7CGV-V83V-RR87Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/ocs-rhel8-operator |
GoRed Hat |
Critical
|
Fix reported |
|
| Sensitive headers incorrectly sent after cross-domain redirect in net/httpCVE-2024-45336 · GO-2025-3420 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm vulnerable to information disclosure via getHostByName Function CVE-2023-25165 · GHSA-PWCW-6F5G-GXF8Version ranges need review. |
helm.sh/helm/v3Cryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
