| Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocationCVE-2026-102554 · GHSA-XXPH-C9WW-HJ94 |
com.google.guava:guavaExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| HTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660 · GO-2026-6610 |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Lack of limit on size of parsed Range headers in net/httpCVE-2026-78667 · GO-2026-6609 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| JsBraceDepth Context Tracking Bugs (XSS) in html/templateCVE-2026-32289 · GO-2026-4865 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/appliance |
GoRed Hat |
Medium
|
Fix reported |
|
| Unbounded allocation for old GNU sparse in archive/tarCVE-2026-32288 · GO-2026-4869 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/assisted-installer-ds-main |
GoRed Hat |
Medium
|
Fix reported |
|
| jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarationsCVE-2026-75140 · GHSA-65R4-943X-97JJ |
org.jsoup:jsoupExploit Intelligence/exploit-intelligence/agent-client-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| Arbitrary inputs are included in errors without any escaping in net/textprotoCVE-2026-42507 · GO-2026-5039 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Invoking Encrypted Client Hello privacy leak in crypto/tlsCVE-2026-42505 · GO-2026-5856 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502 · GO-2026-5027 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| BuildKit has a possible runtime DoS via unbounded group parsingCVE-2026-61712 · GHSA-72X6-4J93-7W86Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| BuildKit: Custom frontend could bypass Seccomp/AppArmorCVE-2026-61711 · GHSA-7236-3392-C5C6Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| jsoup: Cleaner may expose markup with custom raw-text elementsCVE-2026-71497 · GHSA-PMHH-3W7G-XQP8 |
org.jsoup:jsoupCryostat 4/jsoup |
MavenRed Hat |
Medium
|
Fix reported |
|
| Go Net HTML parser is vulnerable to denial of serviceCVE-2026-25680 · GHSA-5CV4-JP36-H3MWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustionCVE-2026-32287 · GHSA-65XW-VW82-R86XVersion ranges need review. |
github.com/antchfx/xpathCompliance Operator/compliance/openshift-compliance-operator-bundle |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputilCVE-2026-39825 · GO-2026-4976 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Escaper bypass leads to XSS in html/templateCVE-2026-39826 · GO-2026-4980 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Bypass of meta content URL escaping causes XSS in html/templateCVE-2026-39823 · GO-2026-4982 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Panic in Dial and LookupPort when handling NUL byte on Windows in netCVE-2026-39836 · GO-2026-4971 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
