| Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsCVE-2026-118264 · GHSA-CXF3-9H37-7RR8Version ranges need review. |
github.com/labstack/echo/v4github.com/labstack/echo/v5 |
GoRed Hat |
Critical
|
Fix reported |
|
| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| Add recursion depth guard during decode in encoding/xmlCVE-2026-56859 · GO-2026-6088 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814 · GO-2026-4918 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821 · GO-2026-5026 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Excessive CPU consumption from repeated initial window changes in net/httpCVE-2026-78669 · GO-2026-6611 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSONCVE-2024-24786 · GHSA-8R3F-844C-MC37Version ranges need review. |
google.golang.org/protobuf/encoding/protojsongoogle.golang.org/protobuf/internal/encoding/json |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana legacy correlations allow cross-tenant disclosure and deletionCVE-2026-21727 · GHSA-P5X9-J974-RPFPVersion ranges need review. |
github.com/grafana/grafanaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| Quadratic string concatenation in consumePhrase in net/mailCVE-2026-42499 · GO-2026-4977 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Quadratic string concatentation in consumeComment in net/mailCVE-2026-39820 · GO-2026-4986 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Inefficient policy validation in crypto/x509CVE-2026-32281 · GO-2026-4946 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/appliance |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81872 · GHSA-HJF4-FPHR-2H65Version ranges need review. |
go.opentelemetry.io/otel/sdk/logAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana: Path traversal in the Tempo and Loki data source pluginsCVE-2026-10601 · GHSA-9493-H4F5-633XVersion ranges need review. |
github.com/grafana/grafanaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana: Pre-authentication denial of service in the public dashboard query handlerCVE-2026-42127 · GHSA-3W66-95M3-8JXGVersion ranges need review. |
github.com/grafana/grafanaRed Hat Ceph Storage 5/rhceph/rhceph-5-dashboard-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81871 · GHSA-W34Q-CM8F-9C5XVersion ranges need review. |
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502 · GO-2026-5027 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto vulnerable to infinite loop on large channel writesCVE-2026-39834 · GHSA-RM3J-F69W-WQMQVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoSCVE-2026-39827 · GHSA-QPW4-5X99-6VJPVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Echo: Encoded slash (%2F) bypasses route-level protection and exposes static filesCVE-2026-55677 · GHSA-VFP3-V2GW-7WFQVersion ranges need review. |
github.com/labstack/echo/v4github.com/labstack/echo/v5 |
GoRed Hat |
High
|
Fix reported |
|
