| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compressCVE-2026-63209 · GHSA-259R-337F-4RFWVersion ranges need review. |
github.com/klauspost/compressFile Integrity Operator/compliance/openshift-file-integrity-operator-bundle |
GoRed Hat |
High
|
Fix reported |
|
| HTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660 · GO-2026-6610 |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81872 · GHSA-HJF4-FPHR-2H65Version ranges need review. |
go.opentelemetry.io/otel/sdk/logAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81871 · GHSA-W34Q-CM8F-9C5XVersion ranges need review. |
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502 · GO-2026-5027 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/htmlCVE-2026-25681 · GO-2026-5029 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlCVE-2026-27136 · GO-2026-5030 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame FragmentationCVE-2026-84304 · GHSA-VP52-PCJ8-J9QCVersion ranges need review. |
google.golang.org/grpcOpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| Docker: `PUT /containers/{id}/archive` executes container binary on the hostCVE-2026-41567 · GHSA-X86F-5XW2-FM2RVersion ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
High
|
Fix reported |
|
| Prometheus Azure AD remote write OAuth client secret exposed via config APICVE-2026-42151 · GHSA-WG65-39GG-5WFJVersion ranges need review. |
github.com/prometheus/prometheusFile Integrity Operator/compliance/openshift-file-integrity-operator-bundle |
GoRed Hat |
High
|
Fix reported |
|
| Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlogCVE-2026-56865 · GO-2026-6179 |
golang.org/x/modtoolchain |
GoRed Hat |
High
|
Fix reported |
|
| Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model LoadersCVE-2026-54499 · GHSA-V5JW-96JM-7H2CVersion ranges need review. |
stanzaRed Hat Ceph Storage 9/rhceph/alloy-rhel10 |
PyPIRed Hat |
High
|
Fix reported |
|
| Apache Thrift has an Improper Validation of Certificate with Host Mismatch VulnerabilityCVE-2026-43869 · GHSA-7PWC-H2J2-RJGJ |
org.apache.thrift:libthriftMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel8 |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource ConsumptionCVE-2026-43870 · GHSA-526F-JXPJ-JMG2 |
thriftRed Hat Advanced Cluster Management for Kubernetes 2/redhat-user-workloads/grafana-acm-213 |
npmRed Hat |
High
|
No fix reported |
|
| Apache Thrift: c_glib: Apache Thrift c_glib: Denial of Service via specially crafted requestsCVE-2025-48431 |
Red Hat AI Inference Server/rhaiis/vllm-cpu-rhel9Red Hat AI Inference Server/rhaiis/vllm-tpu-rhel9 |
Red Hat |
High
|
No fix reported |
|
| github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of compressed dataCVE-2026-94637 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-temporal-rhel9Multicluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
Red Hat |
High
|
No fix reported |
|
| github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transportsCVE-2026-83663 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-temporal-rhel9Multicluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
Red Hat |
High
|
No fix reported |
|
