| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Prevent DoS on deadlocked established channel in golang.org/x/crypto/sshCVE-2026-56855 · GO-2026-6355 |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoSCVE-2026-39827 · GHSA-QPW4-5X99-6VJPVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| sigstore-go has a multi-log threshold bypass via single compromised logCVE-2026-49834 · GHSA-9VCR-P3RJ-Q5Q6Version ranges need review. |
github.com/sigstore/sigstore-goOpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| opentelemetry-go's baggage parsing no longer caps raw header lengthCVE-2026-41178 · GHSA-5WRP-CWCJ-Q835 |
go.opentelemetry.io/otel/baggagego.opentelemetry.io/otel/propagation |
GoRed Hat |
Medium
|
Fix reported |
|
| rardecode: DoS risk due to unrestricted RAR dictionary sizesCVE-2025-11579 · GHSA-RWVP-R38J-9RGGVersion ranges need review. |
github.com/nwaples/rardecode/v2github.com/nwaples/rardecode |
GoRed Hat |
Medium
|
Fix reported |
|
| Fulcio allocates excessive memory during token parsingCVE-2025-66506 · GHSA-F83F-XPX7-FFPWVersion ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Go Net HTML parser is vulnerable to denial of serviceCVE-2026-25680 · GHSA-5CV4-JP36-H3MWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpackCVE-2026-24049 · GHSA-8RRH-RW8J-W5FXVersion ranges need review. |
wheelLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
PyPIRed Hat |
High
|
Fix reported |
|
| Sigstore Timestamp Authority allocates excessive memory during request parsingCVE-2025-66564 · GHSA-4QG8-FJ49-PXJHVersion ranges need review. |
github.com/sigstore/timestamp-authority/v2github.com/sigstore/timestamp-authority |
GoRed Hat |
High
|
Fix reported |
|
| qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionCVE-2025-15284 · GHSA-6RW7-VPXM-498P |
qsLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
npmRed Hat |
Medium
|
Fix reported |
|
| min-document vulnerable to prototype pollutionCVE-2025-57352 · GHSA-RX8G-88G5-QH64 |
min-documentLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
npmRed Hat |
Low
|
Fix reported |
|
| Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/sshCVE-2026-78662 · GO-2026-6354 |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| claircore: claircore: Denial of service via out-of-bounds slice in claircore's apk installed-database parserCVE-2026-16254 |
Red Hat Advanced Cluster Security 4/advanced-cluster-security/rhacs-main-rhel8Red Hat Advanced Cluster Security 4/advanced-cluster-security/rhacs-main-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| claircore: claircore: denial of service via unchecked type assertion in RPM header parserCVE-2026-19519 |
Red Hat Advanced Cluster Security 4/advanced-cluster-security/rhacs-main-rhel8Red Hat Advanced Cluster Security 4/advanced-cluster-security/rhacs-main-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
