Security
فارسی
All products

Red Hat Hardened Images/opentofu1.11

Red Hat · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplificationCVE-2026-128086 · GHSA-RRFC-GJM9-CGRJ go.opentelemetry.io/otel/baggagego.opentelemetry.io/otel/propagation GoRed Hat Medium Fix reported
opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runesCVE-2026-128085 · GHSA-Q7GW-24FR-5P69 go.opentelemetry.io/otel/sdk/loggo.opentelemetry.io/otel/sdk GoRed Hat Medium Fix reported
compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 github.com/klauspost/compress/zstdgithub.com/klauspost/compress GoRed Hat High Fix reported
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compressCVE-2026-63209 · GHSA-259R-337F-4RFWVersion ranges need review. github.com/klauspost/compressFile Integrity Operator/compliance/openshift-file-integrity-operator-bundle GoRed Hat High Fix reported
Panic parsing crafted input in x/text/secure/precis in golang.org/x/textCVE-2026-56851 · GO-2026-6629 golang.org/x/textRed Hat Hardened Images/golang1.25 GoRed Hat High Fix reported
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSONCVE-2024-24786 · GHSA-8R3F-844C-MC37Version ranges need review. google.golang.org/protobuf/encoding/protojsongoogle.golang.org/protobuf/internal/encoding/json GoRed Hat Medium Fix reported
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81872 · GHSA-HJF4-FPHR-2H65Version ranges need review. go.opentelemetry.io/otel/sdk/logAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 GoRed Hat Medium Fix reported
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackCVE-2026-63132 · GHSA-34FC-GH42-PJ53Version ranges need review. github.com/openbao/openbaoRed Hat Hardened Images/opentofu1.11 GoRed Hat Critical Fix reported
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81871 · GHSA-W34Q-CM8F-9C5XVersion ranges need review. go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 GoRed Hat Medium Fix reported
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame FragmentationCVE-2026-84304 · GHSA-VP52-PCJ8-J9QCVersion ranges need review. google.golang.org/grpcOpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel9 GoRed Hat High Fix reported
Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore GoRed Hat Medium Fix reported
go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDsCVE-2026-88031 Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 Red Hat High No fix reported
github.com/hashicorp/go-getter: Go-getter: Privilege escalation via crafted archive decompressionCVE-2026-88922 Exploit Intelligence/exploit-intelligence-tech-preview/agent-client-rhel9Exploit Intelligence/exploit-intelligence/agent-client-rhel9 Red Hat Medium No fix reported
github.com/go-openapi/swag: go-openapi/swag: Denial of Service via uncontrolled JSON recursionCVE-2026-93450 Red Hat Hardened Images/opentofu1.11Red Hat Hardened Images/prometheus3.5 Red Hat High No fix reported
github.com/hashicorp/go-getter: go-getter: arbitrary file write via path traversal in S3 and GCS directory downloadsCVE-2026-19585 Exploit Intelligence/exploit-intelligence/agent-client-rhel9Red Hat Hardened Images/opentofu1.11 Red Hat Medium No fix reported
go.mongodb.org/mongo-driver: MongoDB Go Driver: Denial of Service via integer overflow in BSON processingCVE-2026-107324 Red Hat Hardened Images/opentofu1.11Red Hat Hardened Images/prometheus3.5 Red Hat Medium No fix reported
go.mongodb.org/mongo-driver: MongoDB Go Driver: Denial of Service via malformed BSON array inputCVE-2026-107325 Red Hat Hardened Images/opentofu1.11Red Hat Hardened Images/prometheus3.5 Red Hat Medium No fix reported