| HTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660 · GO-2026-6610 |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Inefficient policy validation in crypto/x509CVE-2026-32281 · GO-2026-4946 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/appliance |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadlineCVE-2026-73500 · GHSA-6VCH-Q96H-7GC3 |
go.etcd.io/etcd/client/pkg/v3go.etcd.io/etcd/v3 |
GoRed Hat |
High
|
Fix reported |
|
| RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependencyCVE-2025-22871 · GHSA-G9PC-8G42-G6VQ |
spiral/roadrunnerstdlib |
ComposerGoRed Hat |
Critical
|
Fix reported |
|
| Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerabilityCVE-2026-41602 · GHSA-WF45-Q9CH-Q8GH |
github.com/apache/thriftMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipCVE-2024-24790 · GO-2024-2887 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Sensitive headers incorrectly sent after cross-domain redirect in net/httpCVE-2024-45336 · GO-2025-3420 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Apache Thrift: Apache Thrift C++ bindings: Denial of Service due to out-of-bounds read via improper input validationCVE-2026-58662 |
Cryostat 4/cryostat/cryostat-storage-rhel9Red Hat Ceph Storage 5/rhceph/snmp-notifier-rhel8 |
Red Hat |
High
|
No fix reported |
|
| Apache Thrift: c_glib: Apache Thrift c_glib: Denial of Service via specially crafted requestsCVE-2025-48431 |
Red Hat AI Inference Server/rhaiis/vllm-cpu-rhel9Red Hat AI Inference Server/rhaiis/vllm-tpu-rhel9 |
Red Hat |
High
|
No fix reported |
|
| github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handlingCVE-2026-14362 |
Red Hat Ceph Storage 5/rhceph/rhceph-5-dashboard-rhel8Red Hat Ceph Storage 5/rhceph/snmp-notifier-rhel8 |
Red Hat |
High
|
No fix reported |
|
| github.com/nats-io/nats-server: NATS Server: Denial of Service via arithmetic overflow in connection monitoring paginationCVE-2026-58207 |
Multicluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9Red Hat Ceph Storage 5/rhceph/snmp-notifier-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed dataCVE-2026-48586 |
Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9Red Hat AI Inference Server/rhaii/vllm-cpu-rhel9 |
Red Hat |
High
|
No fix reported |
|
| thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparoundCVE-2026-55969 |
Confidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-payload-rhel9Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9 |
Red Hat |
High
|
No fix reported |
|
| github.com/grpc-ecosystem/grpc-gateway: github.com/grpc-ecosystem/grpc-gateway/v2: grpc-gateway: Access control bypass via X-HTTP-Method-Override headerCVE-2026-37236 |
Multicluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9OpenShift Serverless/openshift-serverless-1/kn-plugin-event-sender-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDsCVE-2026-88031 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
Red Hat |
High
|
No fix reported |
|
| thrift: Apache Thrift: Arbitrary code execution via heap-based buffer overflow during frame compressionCVE-2026-91135 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-temporal-rhel9Lightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
Red Hat |
High
|
No fix reported |
|
| github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of compressed dataCVE-2026-94637 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-temporal-rhel9Multicluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
Red Hat |
High
|
No fix reported |
|
| github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transportsCVE-2026-83663 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-temporal-rhel9Multicluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
Red Hat |
High
|
No fix reported |
|
| thrift: Apache Thrift: Denial of Service via crafted HTTP requestsCVE-2026-83632 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-temporal-rhel9Cryostat 4/cryostat/cryostat-storage-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
