| go-git missing validation decoding Index v4 files leads to panicCVE-2026-33762 · GHSA-GM2X-2G9H-CCM8Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| BuildKit has a possible runtime DoS via unbounded group parsingCVE-2026-61712 · GHSA-72X6-4J93-7W86Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| BuildKit: Custom frontend could bypass Seccomp/AppArmorCVE-2026-61711 · GHSA-7236-3392-C5C6Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557 · GHSA-QGQ7-7HM3-Q39JVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token LeakageCVE-2026-49478 · GHSA-F5MR-Q85P-6HH6Version ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Docker: Race condition in docker cp allows bind mount redirection to host pathCVE-2026-42306 · GHSA-RG2X-37C3-W2RHVersion ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
High
|
Fix reported |
|
| go-git: Maliciously crafted idx file can cause asymmetric memory consumptionCVE-2026-34165 · GHSA-JHF3-XXHW-2WPPVersion ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalCVE-2026-24137 · GHSA-FCV2-XGW5-PQXFVersion ranges need review. |
github.com/sigstore/sigstoreAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. |
urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| DoS in go-jose ParsingCVE-2025-27144 · GHSA-C6GW-W398-HV78Version ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| github.com/moby/buildkit: BuildKit: Denial of Service via duplicate Git source metadata resolutionCVE-2026-121522 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| github.com/moby/buildkit: BuildKit: Privilege escalation via unauthorized extended file attribute modificationCVE-2026-121520 |
DPU kit for NVIDIA/dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10DPU kit for NVIDIA/dpu-kit-for-nvidia/must-gather-rhel10 |
Red Hat |
High
|
No fix reported |
|
| buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerabilityCVE-2026-15789 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| github.com/moby/buildkit: BuildKit: Denial of Service via malicious client requestCVE-2026-15792 |
Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9Compliance Operator/compliance/openshift-compliance-must-gather-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modificationCVE-2026-75593 |
Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9Compliance Operator/compliance/openshift-compliance-must-gather-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDsCVE-2026-88031 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
Red Hat |
High
|
No fix reported |
|
