| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814 · GO-2026-4918 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81872 · GHSA-HJF4-FPHR-2H65Version ranges need review. |
go.opentelemetry.io/otel/sdk/logAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81871 · GHSA-W34Q-CM8F-9C5XVersion ranges need review. |
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorizationCVE-2026-53719 · GHSA-M2V6-2JMH-4C68Version ranges need review. |
github.com/envoyproxy/gatewayRed Hat Connectivity Link 1/rhcl-1/rhcl-operator-bundle |
GoRed Hat |
Medium
|
Fix reported |
|
| Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitCVE-2026-53716 · GHSA-CXPQ-8V7Q-CG56Version ranges need review. |
github.com/envoyproxy/gatewayRed Hat Connectivity Link 1/rhcl-1/rhcl-operator-bundle |
GoRed Hat |
Medium
|
Fix reported |
|
| Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypassCVE-2026-53718 · GHSA-FCRP-7GC2-93G7Version ranges need review. |
github.com/envoyproxy/gatewayRed Hat Connectivity Link 1/rhcl-1/rhcl-operator-bundle |
GoRed Hat |
Medium
|
Fix reported |
|
| Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret DisclosureCVE-2026-53713 · GHSA-WCRF-9VRR-854FVersion ranges need review. |
github.com/envoyproxy/gatewayRed Hat Connectivity Link 1/rhcl-1/rhcl-rhel9-operator |
GoRed Hat |
Critical
|
Fix reported |
|
| Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerCVE-2026-53717 · GHSA-H7PQ-86H8-RP5XVersion ranges need review. |
github.com/envoyproxy/gatewayRed Hat Connectivity Link 1/rhcl-1/rhcl-operator-bundle |
GoRed Hat |
Medium
|
Fix reported |
|
| Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockCVE-2026-53715 · GHSA-8FV2-88GG-HM7QVersion ranges need review. |
github.com/envoyproxy/gatewayRed Hat Connectivity Link 1/rhcl-1/rhcl-operator-bundle |
GoRed Hat |
Medium
|
Fix reported |
|
| opentelemetry-go's baggage parsing no longer caps raw header lengthCVE-2026-41178 · GHSA-5WRP-CWCJ-Q835 |
go.opentelemetry.io/otel/baggagego.opentelemetry.io/otel/propagation |
GoRed Hat |
Medium
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Excessive resource consumption when printing error string for host certificate validation in crypto/x509CVE-2025-61729 · GO-2025-4155 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Lack of limit when parsing cookies can cause memory exhaustion in net/httpCVE-2025-58186 · GO-2025-4012 |
stdlibCryostat 4/cryostat/cryostat-grafana-dashboard-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| cert-manager-controller DoS via Specially Crafted DNS ResponseCVE-2026-25518 · GHSA-GX3X-VQ4P-MHHVVersion ranges need review. |
github.com/cert-manager/cert-managerCryostat 4/cryostat/cryostat-rhel9-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| istio: Istio: Firewall rule injection via annotation allows limited integrity impactCVE-2026-23766 |
ExternalDNS Operator/edo/external-dns-rhel8ExternalDNS Operator/edo/external-dns-rhel9 |
Red Hat |
Unknown
|
No fix reported |
|
| istio: Istio: Authorization policy bypass via Envoy RBAC header matching with multiple header valuesCVE-2026-31838 |
ExternalDNS Operator/edo/external-dns-rhel8ExternalDNS Operator/edo/external-dns-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| k8s.io/kubectl: Kubernetes kubectl: Arbitrary file write via path traversal on WindowsCVE-2026-19444 |
DPU kit for NVIDIA/dpu-kit-for-nvidia/must-gather-rhel10Multicluster Engine for Kubernetes/multicluster-engine/registration-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
