| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compressCVE-2026-63209 · GHSA-259R-337F-4RFWVersion ranges need review. |
github.com/klauspost/compressFile Integrity Operator/compliance/openshift-file-integrity-operator-bundle |
GoRed Hat |
High
|
Fix reported |
|
| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Unbounded allocation when parsing GNU sparse map in archive/tarCVE-2025-58183 · GO-2025-4014 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Prevent DoS on deadlocked established channel in golang.org/x/crypto/sshCVE-2026-56855 · GO-2026-6355 |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responsesCVE-2026-39830 · GHSA-VGWF-H737-FF37Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502 · GO-2026-5027 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/htmlCVE-2026-25681 · GO-2026-5029 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flowCVE-2026-39835 · GHSA-78MQ-XCR3-XM33Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto vulnerable to infinite loop on large channel writesCVE-2026-39834 · GHSA-RM3J-F69W-WQMQVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlCVE-2026-27136 · GO-2026-5030 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoSCVE-2026-39827 · GHSA-QPW4-5X99-6VJPVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassedCVE-2026-39831 · GHSA-89GR-R52H-F8RXVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| golang.org/x/crypto: Invoking byte arithmetic causes underflow and panicCVE-2026-46597 · GHSA-Q4H4-GMJ2-QVW2Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoSCVE-2026-39829 · GHSA-W879-237Q-WC7RVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| go-git: Worktree operations may follow symlinksCVE-2026-71556 · GHSA-HC8V-WWC9-VGXMVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
High
|
Fix reported |
|
| BuildKit has a possible runtime DoS via unbounded group parsingCVE-2026-61712 · GHSA-72X6-4J93-7W86Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
