| knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionCVE-2026-54462 · GHSA-2HW4-C9M4-F2FJVersion ranges need review. |
knative.dev/pkgBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel10 |
GoRed Hat |
Medium
|
Fix reported |
|
| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| chi Has an IP Spoofing Vulnerability in `middleware.RealIP`CVE-2026-72815 · GHSA-3FXJ-6JH8-HVHXVersion ranges need review. |
github.com/go-chi/chi/v5/middlewaregithub.com/go-chi/chi/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| Distrust compromised intermediate certificates in crypto/x509CVE-2026-111943 · GO-2026-6809 |
rustls-webpkiwebpki-root-certs |
Rust / CargoGoRed Hat |
High
|
Fix reported |
|
| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Lack of limit on size of parsed Range headers in net/httpCVE-2026-78667 · GO-2026-6609 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| Excessive CPU consumption from repeated initial window changes in net/httpCVE-2026-78669 · GO-2026-6611 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Reject malformed ECH outer extension references in crypto/tlsCVE-2026-97031 · GO-2026-6607 |
stdlibExploit Intelligence/exploit-intelligence/exploit-intelligence-operator-controller-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpCVE-2026-56853 · GO-2026-6089 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto vulnerable to infinite loop on large channel writesCVE-2026-39834 · GHSA-RM3J-F69W-WQMQVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Excessive memory allocation when decoding malicious SFNT in golang.org/x/imageCVE-2026-33812 · GO-2026-4962 |
golang.org/x/imageCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoSCVE-2026-39827 · GHSA-QPW4-5X99-6VJPVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| pgx: SQL Injection via placeholder confusion with dollar quoted string literalsCVE-2026-41889 · GHSA-J88V-2CHJ-QFWXVersion ranges need review. |
github.com/jackc/pgx/v4github.com/jackc/pgx/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Transformers is vulnerable to ReDoS attack through its DonutProcessor classCVE-2025-3933 · GHSA-37MW-44QP-F5JMVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For headerCVE-2026-72816 · GHSA-RJR7-JGGH-PGCP |
github.com/go-chi/chi/middlewaregithub.com/go-chi/chi/v2/middleware |
GoRed Hat |
High
|
Fix reported |
|
| chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` ResolutionCVE-2026-72817 · GHSA-9G5Q-2W5X-HMXF |
github.com/go-chi/chi/middlewaregithub.com/go-chi/chi/v2/middleware |
GoRed Hat |
High
|
Fix reported |
|
| Docker: `PUT /containers/{id}/archive` executes container binary on the hostCVE-2026-41567 · GHSA-X86F-5XW2-FM2RVersion ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
High
|
Fix reported |
|
