| Root.Mkdir(All) can follow junctions out of the root on Windows in osCVE-2026-56857 · GO-2026-6604 |
stdlibOpenShift Developer Tools and Services/helm |
GoRed Hat |
Low
|
Fix reported |
|
| Excessive memory allocation when decoding malicious SFNT in golang.org/x/imageCVE-2026-33812 · GO-2026-4962 |
golang.org/x/imageCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Go Images vulnerable to an out-of-memory error via a crafted TIFF fileCVE-2026-33809 · GHSA-44P7-9XX4-HF2GVersion ranges need review. |
golang.org/x/imageCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Handshake messages may be processed at the incorrect encryption level in crypto/tlsCVE-2025-61730 · GO-2026-4340 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Stack exhaustion in Parse in go/build/constraintCVE-2024-34158 · GO-2024-3107 |
stdlibMachine Deletion Remediation Operator/workload-availability/machine-deletion-remediation-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Kratos has a Confused Deputy issueCVE-2026-6993 · GHSA-JJ45-XVQ5-RHH9Version ranges need review. |
github.com/go-kratos/kratos/v2Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
No fix reported |
|
| Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyCVE-2026-53769 · GHSA-PQPW-CVM4-8MV9 |
Red Hat Enterprise Linux 10/golangRed Hat Enterprise Linux 8/go-toolset:rhel8/golang |
Red HatRubyGems |
Medium
|
Fix reported |
|
| Quadratic complexity when parsing some invalid inputs in encoding/pemCVE-2025-61723 · GO-2025-4009 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| CrossOriginProtection insecure bypass patterns not limited to exact matches in net/httpCVE-2025-47910 · GO-2025-3955 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| ALPN negotiation error contains attacker controlled information in crypto/tlsCVE-2025-58189 · GO-2025-4008 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Excessive CPU consumption in ParseAddress in net/mailCVE-2025-61725 · GO-2025-4006 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Infinite parsing loop in golang.org/x/netCVE-2025-58190 · GO-2026-4441 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| URLs in meta content attribute actions are not escaped in html/templateCVE-2026-27142 · GO-2026-4603 |
stdlibOpenShift Service Mesh 2/openshift-golang-builder-container |
GoRed Hat |
Medium
|
Fix reported |
|
| Panic in name constraint checking for malformed certificates in crypto/x509CVE-2026-27138 · GO-2026-4600 |
stdlibOpenShift Service Mesh 2/openshift-golang-builder-container |
GoRed Hat |
Low
|
Fix reported |
|
| FileInfo can escape from a Root in osCVE-2026-27139 · GO-2026-4602 |
stdlibOpenShift Service Mesh 2/openshift-golang-builder-container |
GoRed Hat |
Low
|
Fix reported |
|
| Parsing DER payload can cause memory exhaustion in encoding/asn1CVE-2025-58185 · GO-2025-4011 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Unexpected code execution when invoking toolchain in cmd/goCVE-2025-68119 · GO-2026-4338 |
toolchainRed Hat Enterprise Linux 10/golang |
GoRed Hat |
Medium
|
Fix reported |
|
| Improper access to parent directory of root in osCVE-2025-22873 · GO-2026-4403 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipCVE-2024-24790 · GO-2024-2887 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of service due to improper 100-continue handling in net/httpCVE-2024-24791 · GO-2024-2963 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
