| go-git missing validation decoding Index v4 files leads to panicCVE-2026-33762 · GHSA-GM2X-2G9H-CCM8Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| BuildKit has a possible runtime DoS via unbounded group parsingCVE-2026-61712 · GHSA-72X6-4J93-7W86Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| BuildKit: Custom frontend could bypass Seccomp/AppArmorCVE-2026-61711 · GHSA-7236-3392-C5C6Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pullCVE-2026-53488 · GHSA-XHF5-7WJV-PQXPVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
High
|
Fix reported |
|
| containerd CRI checkpoint restore CDI annotation smugglingCVE-2026-53492 · GHSA-33VJ-92QQ-66HCVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
High
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| BuildKit Git URL subdir component can cause access to restricted filesCVE-2026-33748 · GHSA-4VRQ-3VRQ-G6GGVersion ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| go-git improperly verifies data integrity values for .idx and .pack filesCVE-2026-25934 · GHSA-37CX-329C-33X3Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URLCVE-2026-24117 · GHSA-4C4X-JM2X-PF9JVersion ranges need review. |
github.com/sigstore/rekorAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Fulcio allocates excessive memory during token parsingCVE-2025-66506 · GHSA-F83F-XPX7-FFPWVersion ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557 · GHSA-QGQ7-7HM3-Q39JVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token LeakageCVE-2026-49478 · GHSA-F5MR-Q85P-6HH6Version ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Go JOSE Panics in JWE decryptionCVE-2026-34986 · GHSA-78H2-9FRX-2JM8Version ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
High
|
Fix reported |
|
| go-git: Credential leak via cross-host redirect in smart HTTP transportCVE-2026-41506 · GHSA-3XC5-WRHM-F963Version ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Maliciously crafted idx file can cause asymmetric memory consumptionCVE-2026-34165 · GHSA-JHF3-XXHW-2WPPVersion ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| BuildKit's Malicious frontend can cause file escape outside of storage rootCVE-2026-33747 · GHSA-4C29-8RGM-JVJJVersion ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalCVE-2026-24137 · GHSA-FCV2-XGW5-PQXFVersion ranges need review. |
github.com/sigstore/sigstoreAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
