| CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` pluginCVE-2026-62994 · GHSA-74W3-63XV-X9MVVersion ranges need review. |
github.com/coredns/corednsRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/lighthouse-agent-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSONCVE-2024-24786 · GHSA-8R3F-844C-MC37Version ranges need review. |
google.golang.org/protobuf/encoding/protojsongoogle.golang.org/protobuf/internal/encoding/json |
GoRed Hat |
Medium
|
Fix reported |
|
| CoreDNS: Unauthenticated memory exhaustion in custom transportsCVE-2026-82399 · GHSA-MRG3-QVQR-JW29Version ranges need review. |
github.com/coredns/corednsRed Hat Connectivity Link 1/rhcl-1/coredns-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCPCVE-2026-86003 · GHSA-9GM5-9RFH-M6VXVersion ranges need review. |
github.com/coredns/corednsRed Hat Connectivity Link 1/rhcl-1/coredns-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPCCVE-2026-33190 · GHSA-QHMP-Q7XH-99RHVersion ranges need review. |
github.com/coredns/corednsRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/lighthouse-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| CoreDNS' DoQ worker pool does not bound stream backlogCVE-2026-32934 · GHSA-2WPX-QPW2-G5H5Version ranges need review. |
github.com/coredns/corednsRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/lighthouse-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Insecure Temporary File usage in github.com/golang/glogCVE-2024-45339 · GHSA-6WXM-MPQJ-6JPFVersion ranges need review. |
github.com/golang/glogMulticluster Engine for Kubernetes/multicluster-engine/assisted-service-9-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion CVE-2026-40898 · GHSA-VVGJ-X9JQ-8CJ9Version ranges need review. |
github.com/quic-go/quic-goRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/lighthouse-coredns-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass)CVE-2026-33489 · GHSA-H8MM-C463-WJQ3Version ranges need review. |
github.com/coredns/corednsRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/lighthouse-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messagesCVE-2025-68151 · GHSA-527X-5WRF-22M2Version ranges need review. |
github.com/coredns/corednsRed Hat OpenShift Container Platform 4/openshift4/ose-coredns-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| quic-go affected by an ICMP Packet Too Large Injection Attack on LinuxCVE-2024-53259 · GHSA-PX8V-PP82-RCVRVersion ranges need review. |
github.com/quic-go/quic-goOpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| quic-go's path validation mechanism can be exploited to cause denial of serviceCVE-2023-49295 · GHSA-PPXX-5M9H-6VXFVersion ranges need review. |
github.com/quic-go/quic-goOpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Uncontrolled Resource Consumption in promhttpCVE-2022-21698 · GHSA-CG3Q-J54F-5P7PVersion ranges need review. |
github.com/prometheus/client_golangCost Management Metrics Operator/costmanagement-metrics-operator-container |
GoRed Hat |
High
|
Fix reported |
|
| Handshake messages may be processed at the incorrect encryption level in crypto/tlsCVE-2025-61730 · GO-2026-4340 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Authorization bypass in github.com/dgrijalva/jwt-goCVE-2020-26160 · GHSA-W73W-5M7G-F7QCVersion ranges need review. |
github.com/dgrijalva/jwt-go/v4github.com/dgrijalva/jwt-go |
GoRed Hat |
High
|
Fix reported |
|
| Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment functionCVE-2023-29401 · GHSA-2C4M-59X9-FR2GVersion ranges need review. |
github.com/gin-gonic/ginMigration Toolkit for Applications 6/mta/mta-admin-addon-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| github.com/coredns/coredns: CoreDNS: Denial of Service via crafted UDP datagram with proxyproto pluginCVE-2026-62309 |
Red Hat Connectivity Link 1/rhcl-1/coredns-rhel9Red Hat OpenShift Container Platform 4/openshift4/ose-coredns-rhel9 |
Red Hat |
High
|
No fix reported |
|
| github.com/coredns/coredns: CoreDNS: Denial of Service via specially crafted DNS queryCVE-2026-62299 |
Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/lighthouse-agent-rhel9Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/lighthouse-coredns-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
