| knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionCVE-2026-54462 · GHSA-2HW4-C9M4-F2FJVersion ranges need review. |
knative.dev/pkgBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel10 |
GoRed Hat |
Medium
|
Fix reported |
|
| Enforce maximum recursion depth in encoding/asn1CVE-2026-33818 · GO-2026-5972 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/net vulnerable to Cross-site ScriptingCVE-2025-22872 · GHSA-VVGC-356P-C3XWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| DoS in go-jose ParsingCVE-2025-27144 · GHSA-C6GW-W398-HV78Version ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situationsCVE-2024-51744 · GHSA-29WX-VH33-7X7RVersion ranges need review. |
github.com/golang-jwt/jwt/v4Builds for Red Hat OpenShift/openshift-builds-triggers-container |
GoRed Hat |
Low
|
Fix reported |
|
| goproxy Denial of Service vulnerabilityCVE-2023-37788 · GHSA-4R8X-2P26-976PVersion ranges need review. |
github.com/elazarl/goproxyLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2025-4166 · GHSA-GCQF-F89C-68HVVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSCVE-2026-5052 · GHSA-8R5M-3F66-QPR3Version ranges need review. |
github.com/hashicorp/vaultRed Hat OpenShift Container Platform 4/openshift4/ose-baremetal-installer-rhel9 |
GoRed Hat |
Medium
|
No fix reported |
|
| HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsCVE-2026-5807 · GHSA-88V5-9HXC-F85RVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/mcg-cli-rhel9 |
GoRed Hat |
High
|
No fix reported |
|
| HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header SanitizationCVE-2026-4525 · GHSA-72GW-FMMR-C4R4Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/mcg-cli-rhel9 |
GoRed Hat |
High
|
No fix reported |
|
| HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-ServiceCVE-2026-3605 · GHSA-M2W4-8GGF-RJ47Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/mcg-cli-rhel9 |
GoRed Hat |
High
|
No fix reported |
|
| Infinite parsing loop in golang.org/x/netCVE-2025-58190 · GO-2026-4441 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependencyCVE-2025-22871 · GHSA-G9PC-8G42-G6VQ |
spiral/roadrunnerstdlib |
ComposerGoRed Hat |
Critical
|
Fix reported |
|
| Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityCVE-2025-6015 · GHSA-V6R4-35F9-9RPWVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse CVE-2025-6014 · GHSA-QV3P-FMV3-9HWWVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault's PKI mount vulnerable to denial of serviceCVE-2023-0665 · GHSA-HWC3-3QH6-R4GGVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/sys/unix has Incorrect privilege reporting in syscallCVE-2022-29526 · GHSA-P782-XGP4-8HR8Version ranges need review. |
golang.org/x/sysstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration FileCVE-2023-0620 · GHSA-V3HP-MCJ5-PG39Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacksCVE-2023-25000 · GHSA-VQ4H-9GHM-QMRRVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersCVE-2025-6011 · GHSA-MWGR-84FV-3JH9Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
