| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502 · GO-2026-5027 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensCVE-2026-48978 · GHSA-XF85-363P-868WVersion ranges need review. |
oras.land/oras-go/v2oras.land/oras-go |
GoRed Hat |
Low
|
Fix reported |
|
| oras-go blob upload vulnerable to credential forwarding via unvalidated Location headerCVE-2026-50151 · GHSA-JXPM-75MH-9FP7Version ranges need review. |
oras.land/oras-go/v2OpenShift Service Mesh 3/openshift-service-mesh/istio-rhel9-operator |
GoRed Hat |
High
|
Fix reported |
|
| `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolutionCVE-2026-50163 · GHSA-FXHP-MV3V-67QPVersion ranges need review. |
oras.land/oras-go/v2Gatekeeper 3/gatekeeper/gatekeeper-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Go Net HTML parser is vulnerable to denial of serviceCVE-2026-25680 · GHSA-5CV4-JP36-H3MWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| Node Denial of Service via kubelet Checkpoint APICVE-2025-0426 · GHSA-JGFP-53C3-624WVersion ranges need review. |
k8s.io/kubernetesBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Improper rendering of text nodes in golang.org/x/net/htmlCVE-2023-3978 · GHSA-2WRH-6PVC-2JM9Version ranges need review. |
golang.org/x/netOpenShift API for Data Protection/oadp/oadp-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Supplementary groups are not set up properly in github.com/containerd/containerdCVE-2023-25173 · GHSA-HMFX-3PCX-653PVersion ranges need review. |
github.com/containerd/containerdCryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/text/language Out-of-bounds Read vulnerabilityCVE-2021-38561 · GHSA-PPP9-7JFF-5VJ2Version ranges need review. |
golang.org/x/textOpenShift Developer Tools and Services/odo |
GoRed Hat |
High
|
Fix reported |
|
| Uncontrolled Resource Consumption in promhttpCVE-2022-21698 · GHSA-CG3Q-J54F-5P7PVersion ranges need review. |
github.com/prometheus/client_golangCost Management Metrics Operator/costmanagement-metrics-operator-container |
GoRed Hat |
High
|
Fix reported |
|
| Helm's Missing YAML Content Leads To PanicCVE-2024-26147 · GHSA-R53H-JV2G-VPX6Version ranges need review. |
helm.sh/helm/v3Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/multicluster-operators-channel-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Mishandling of corrupt central directory record in archive/zipCVE-2024-24789 · GO-2024-2888 |
stdlibCustom Metric Autoscaler operator for Red Hat Openshift/custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| net/http, x/net/http2: close connections when receiving too many headersCVE-2023-45288 · GHSA-4V7X-PQXF-CX7MVersion ranges need review. |
golang.org/x/net/http2golang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm Charts with Specific JSON Schema Values Can Cause Memory ExhaustionCVE-2025-55199 · GHSA-9H84-QMV7-982PVersion ranges need review. |
helm.sh/helm/v3helm.sh/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm May Panic Due To Incorrect YAML ContentCVE-2025-55198 · GHSA-F9F8-9PMF-XV68Version ranges need review. |
helm.sh/helm/v3helm.sh/helm |
GoRed Hat |
Medium
|
Fix reported |
|
