| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821 · GO-2026-5026 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Infinite loop on invalid input in golang.org/x/textCVE-2026-56852 · GO-2026-5970 |
golang.org/x/textAWS Load Balancer Operator/albo/aws-load-balancer-rhel9-operator |
GoRed Hat |
High
|
Fix reported |
|
| Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502 · GO-2026-5027 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| opentelemetry-go's baggage parsing no longer caps raw header lengthCVE-2026-41178 · GHSA-5WRP-CWCJ-Q835 |
go.opentelemetry.io/otel/baggagego.opentelemetry.io/otel/propagation |
GoRed Hat |
Medium
|
Fix reported |
|
| Go Net HTML parser is vulnerable to denial of serviceCVE-2026-25680 · GHSA-5CV4-JP36-H3MWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Go JOSE Panics in JWE decryptionCVE-2026-34986 · GHSA-78H2-9FRX-2JM8Version ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
High
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds readCVE-2025-47914 · GHSA-F6X5-JH6R-WRFVVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumptionCVE-2025-58181 · GHSA-J5W8-Q4QC-RX2XVersion ranges need review. |
golang.org/x/cryptoBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archivesCVE-2025-58058 · GHSA-JC7W-C686-C4V9Version ranges need review. |
github.com/ulikunitz/xzAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net vulnerable to Cross-site ScriptingCVE-2025-22872 · GHSA-VVGC-356P-C3XWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870 · GHSA-QXP5-GWG8-XV66Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key ExchangeCVE-2025-22869 · GHSA-HCG3-Q754-CR77Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-reporter-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageCVE-2026-46600 · GO-2026-5942 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Excessive resource consumption when printing error string for host certificate validation in crypto/x509CVE-2025-61729 · GO-2025-4155 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
