Security
فارسی
All products

Red Hat Ceph Storage 9/rhceph/alloy-rhel10

Red Hat · Package
148 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 github.com/klauspost/compress/zstdgithub.com/klauspost/compress GoRed Hat High Fix reported
protobufjs has an arbitrary code execution issueCVE-2026-41242 · GHSA-XQ3M-2V4X-88GG protobufjsOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-rhel8 npmRed Hat Critical Fix reported
deepmerge mergeObject() allows prototype poisoning of returned objectsCVE-2026-93753 · GHSA-GCQX-W48M-W2H4 deepmergeCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Low No fix reported
Enforce maximum recursion depth in encoding/asn1CVE-2026-33818 · GO-2026-5972 stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator GoRed Hat High Fix reported
Fix Javascript regexp context tracking in html/templateCVE-2026-56858 · GO-2026-6091 stdlibAWS Load Balancer Operator/albo/aws-load-balancer-controller-rhel8 GoRed Hat High Fix reported
Add recursion depth guard during decode in encoding/xmlCVE-2026-56859 · GO-2026-6088 stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator GoRed Hat High Fix reported
Limit handshake messages we are willing to accept post-handshake in crypto/tlsCVE-2026-56862 · GO-2026-6090 stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator GoRed Hat High Fix reported
Avoid quadratic complexity in resolvePath in net/urlCVE-2026-56860 · GO-2026-6218 stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator GoRed Hat High Fix reported
github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 GoRed Hat Medium Fix reported
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814 · GO-2026-4918 golang.org/x/netstdlib GoRed Hat High Fix reported
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821 · GO-2026-5026 golang.org/x/netstdlib GoRed Hat High Fix reported
HTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660 · GO-2026-6610 golang.org/x/netstdlib GoRed Hat Medium Fix reported
Quadratic string concatenation in consumePhrase in net/mailCVE-2026-42499 · GO-2026-4977 stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 GoRed Hat High Fix reported
Quadratic string concatentation in consumeComment in net/mailCVE-2026-39820 · GO-2026-4986 stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 GoRed Hat High Fix reported
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpCVE-2026-56853 · GO-2026-6089 stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator GoRed Hat High Fix reported
source-map-js allows event-loop denial of service through indexed source-map section offsetsCVE-2026-93749 · GHSA-68FV-2MGG-JV7Q source-map-jsNode HealthCheck Operator/redhat-user-workloads/nhc-bundle-0-9 npmRed Hat High Fix reported
Arbitrary inputs are included in errors without any escaping in net/textprotoCVE-2026-42507 · GO-2026-5039 stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 GoRed Hat Medium Fix reported
Invoking Encrypted Client Hello privacy leak in crypto/tlsCVE-2026-42505 · GO-2026-5856 stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 GoRed Hat Medium Fix reported
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 dompurifyCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Low Fix reported
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81872 · GHSA-HJF4-FPHR-2H65Version ranges need review. go.opentelemetry.io/otel/sdk/logAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 GoRed Hat Medium Fix reported