| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814 · GO-2026-4918 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Unbounded allocation when parsing GNU sparse map in archive/tarCVE-2025-58183 · GO-2025-4014 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Worktree operations may follow symlinksCVE-2026-71556 · GHSA-HC8V-WWC9-VGXMVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
High
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git improperly verifies data integrity values for .idx and .pack filesCVE-2026-25934 · GHSA-37CX-329C-33X3Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557 · GHSA-QGQ7-7HM3-Q39JVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensCVE-2026-48978 · GHSA-XF85-363P-868WVersion ranges need review. |
oras.land/oras-go/v2oras.land/oras-go |
GoRed Hat |
Low
|
Fix reported |
|
| oras-go blob upload vulnerable to credential forwarding via unvalidated Location headerCVE-2026-50151 · GHSA-JXPM-75MH-9FP7Version ranges need review. |
oras.land/oras-go/v2OpenShift Service Mesh 3/openshift-service-mesh/istio-rhel9-operator |
GoRed Hat |
High
|
Fix reported |
|
| `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolutionCVE-2026-50163 · GHSA-FXHP-MV3V-67QPVersion ranges need review. |
oras.land/oras-go/v2Gatekeeper 3/gatekeeper/gatekeeper-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Go Net HTML parser is vulnerable to denial of serviceCVE-2026-25680 · GHSA-5CV4-JP36-H3MWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archivesCVE-2025-58058 · GHSA-JC7W-C686-C4V9Version ranges need review. |
github.com/ulikunitz/xzAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed DataCVE-2025-11065 · GHSA-2464-8J7C-4CJMVersion ranges need review. |
github.com/go-viper/mapstructure/v2github.com/go-viper/mapstructure |
GoRed Hat |
Medium
|
Fix reported |
|
| Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situationsCVE-2024-51744 · GHSA-29WX-VH33-7X7RVersion ranges need review. |
github.com/golang-jwt/jwt/v4Builds for Red Hat OpenShift/openshift-builds-triggers-container |
GoRed Hat |
Low
|
Fix reported |
|
| Authorization bypass in github.com/dgrijalva/jwt-goCVE-2020-26160 · GHSA-W73W-5M7G-F7QCVersion ranges need review. |
github.com/dgrijalva/jwt-go/v4github.com/dgrijalva/jwt-go |
GoRed Hat |
High
|
Fix reported |
|
| Helm vulnerable to denial of service through string value parsingCVE-2022-23524 · GHSA-6RX9-889Q-VV2RVersion ranges need review. |
helm.sh/helm/v3OpenShift Developer Tools and Services/jenkins-operator-container |
GoRed Hat |
Medium
|
Fix reported |
|
