| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660 · GO-2026-6610 |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Lack of limit on size of parsed Range headers in net/httpCVE-2026-78667 · GO-2026-6609 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| Sensitive headers not cleared on cross-origin redirect in net/httpCVE-2025-4673 · GO-2025-3751 |
stdlibCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| JsBraceDepth Context Tracking Bugs (XSS) in html/templateCVE-2026-32289 · GO-2026-4865 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/appliance |
GoRed Hat |
Medium
|
Fix reported |
|
| Unbounded allocation for old GNU sparse in archive/tarCVE-2026-32288 · GO-2026-4869 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/assisted-installer-ds-main |
GoRed Hat |
Medium
|
Fix reported |
|
| Inefficient policy validation in crypto/x509CVE-2026-32281 · GO-2026-4946 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/appliance |
GoRed Hat |
Medium
|
Fix reported |
|
| Arbitrary inputs are included in errors without any escaping in net/textprotoCVE-2026-42507 · GO-2026-5039 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Invoking Encrypted Client Hello privacy leak in crypto/tlsCVE-2026-42505 · GO-2026-5856 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| pgx: SQL Injection via placeholder confusion with dollar quoted string literalsCVE-2026-41889 · GHSA-J88V-2CHJ-QFWXVersion ranges need review. |
github.com/jackc/pgx/v4github.com/jackc/pgx/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| Go Net HTML parser is vulnerable to denial of serviceCVE-2026-25680 · GHSA-5CV4-JP36-H3MWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identityCVE-2026-26958 · GHSA-FW7P-63QQ-7HPRVersion ranges need review. |
filippo.io/edwards25519Cryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| golang.org/x/net vulnerable to Cross-site ScriptingCVE-2025-22872 · GHSA-VVGC-356P-C3XWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputilCVE-2026-39825 · GO-2026-4976 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Escaper bypass leads to XSS in html/templateCVE-2026-39826 · GO-2026-4980 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Bypass of meta content URL escaping causes XSS in html/templateCVE-2026-39823 · GO-2026-4982 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
