| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| HTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660 · GO-2026-6610 |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Lack of limit on size of parsed Range headers in net/httpCVE-2026-78667 · GO-2026-6609 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Arbitrary inputs are included in errors without any escaping in net/textprotoCVE-2026-42507 · GO-2026-5039 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Invoking Encrypted Client Hello privacy leak in crypto/tlsCVE-2026-42505 · GO-2026-5856 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent accessCVE-2026-45404 · GHSA-42CJ-99W8-CP2PVersion ranges need review. |
go.opentelemetry.io/otel/bridge/opentracingMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReaderCVE-2026-10722 · GHSA-XHGW-QWWF-PG32Version ranges need review. |
github.com/cilium/ebpfConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| @tootallnate/once vulnerable to Incorrect Control Flow ScopingCVE-2026-3449 · GHSA-VPQ2-C234-7XJ6 |
@tootallnate/onceConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Low
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870 · GHSA-QXP5-GWG8-XV66Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situationsCVE-2024-51744 · GHSA-29WX-VH33-7X7RVersion ranges need review. |
github.com/golang-jwt/jwt/v4Builds for Red Hat OpenShift/openshift-builds-triggers-container |
GoRed Hat |
Low
|
Fix reported |
|
| golang.org/x/text/language Out-of-bounds Read vulnerabilityCVE-2021-38561 · GHSA-PPP9-7JFF-5VJ2Version ranges need review. |
golang.org/x/textOpenShift Developer Tools and Services/odo |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/text/language Denial of service via crafted Accept-Language headerCVE-2022-32149 · GHSA-69CH-W2M2-3VJPVersion ranges need review. |
golang.org/x/textOpenShift Developer Tools and Services/odo |
GoRed Hat |
High
|
Fix reported |
|
| x/crypto/ssh vulnerable to panic via malformed packetsCVE-2021-43565 · GHSA-GWC9-M7RH-J2WWVersion ranges need review. |
golang.org/x/cryptoMigration Toolkit for Containers/rhmtc/openshift-migration-velero-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Bypass of meta content URL escaping causes XSS in html/templateCVE-2026-39823 · GO-2026-4982 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Excessive CPU consumption when building archive index in archive/zipCVE-2025-61728 · GO-2026-4342 |
stdlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/http2/h2c vulnerable to request smuggling attackCVE-2022-41721 · GHSA-FXG5-WQ6X-VR4WVersion ranges need review. |
golang.org/x/netOpenShift Serverless/cli |
GoRed Hat |
High
|
Fix reported |
|
| Cilium node based network policies may incorrectly allow workload trafficCVE-2025-30163 · GHSA-C6PF-2V8J-96MCVersion ranges need review. |
github.com/cilium/ciliumNetwork Observability Operator/network-observability/network-observability-ebpf-agent-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
