| Go JOSE: Panic during CBC-HMAC processingCVE-2026-116585 · GHSA-4W3G-JFJ2-CW2Q |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| Go JOSE: Panics in JSON parsingCVE-2026-116586 · GHSA-VVM8-GF78-28G4 |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| Go JOSE: DoS when parsing JWKs that contain RSA keysCVE-2026-116587 · GHSA-MGCC-CWW5-FP2Q |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
High
|
Fix reported |
|
| Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814 · GO-2026-4918 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Quadratic string concatenation in consumePhrase in net/mailCVE-2026-42499 · GO-2026-4977 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Quadratic string concatentation in consumeComment in net/mailCVE-2026-39820 · GO-2026-4986 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283 · GO-2026-4870 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Unexpected work during chain building in crypto/x509CVE-2026-32280 · GO-2026-4947 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Inefficient candidate hostname parsing in crypto/x509CVE-2026-27145 · GO-2026-5037 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Crash when handling long CNAME response in netCVE-2026-33811 · GO-2026-4981 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responsesCVE-2026-39830 · GHSA-VGWF-H737-FF37Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/htmlCVE-2026-25681 · GO-2026-5029 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlCVE-2026-27136 · GO-2026-5030 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Root escape via symlink plus trailing slash in osCVE-2026-39822 · GO-2026-4970 |
stdlibExternalDNS Operator/edo/external-dns-rhel9-operator |
GoRed Hat |
High
|
Fix reported |
|
| gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame FragmentationCVE-2026-84304 · GHSA-VP52-PCJ8-J9QCVersion ranges need review. |
google.golang.org/grpcMulticluster Engine for Kubernetes/multicluster-engine/addon-manager-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keysCVE-2026-39832 · GHSA-F5WC-C3C7-36MCVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked statusCVE-2026-42508 · GHSA-5CGQ-3RG8-M6CVVersion ranges need review. |
golang.org/x/cryptoExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/external-secrets-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcementCVE-2026-46595 · GHSA-X527-X647-Q7GGVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/sshCVE-2026-56854 · GO-2026-6303 |
golang.org/x/cryptoExternalDNS Operator/edo/external-dns-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadlineCVE-2026-73500 · GHSA-6VCH-Q96H-7GC3 |
go.etcd.io/etcd/client/pkg/v3go.etcd.io/etcd/v3 |
GoRed Hat |
High
|
Fix reported |
|
