| Prevent DoS on deadlocked established channel in golang.org/x/crypto/sshCVE-2026-56855 · GO-2026-6355 |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto vulnerable to infinite loop on large channel writesCVE-2026-39834 · GHSA-RM3J-F69W-WQMQVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoSCVE-2026-39827 · GHSA-QPW4-5X99-6VJPVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token LeakageCVE-2026-49478 · GHSA-F5MR-Q85P-6HH6Version ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identityCVE-2026-26958 · GHSA-FW7P-63QQ-7HPRVersion ranges need review. |
filippo.io/edwards25519Cryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalCVE-2026-24137 · GHSA-FCV2-XGW5-PQXFVersion ranges need review. |
github.com/sigstore/sigstoreAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds readCVE-2025-47914 · GHSA-F6X5-JH6R-WRFVVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumptionCVE-2025-58181 · GHSA-J5W8-Q4QC-RX2XVersion ranges need review. |
golang.org/x/cryptoBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed DataCVE-2025-11065 · GHSA-2464-8J7C-4CJMVersion ranges need review. |
github.com/go-viper/mapstructure/v2github.com/go-viper/mapstructure |
GoRed Hat |
Medium
|
Fix reported |
|
| Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/sshCVE-2026-78662 · GO-2026-6354 |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityCVE-2025-6015 · GHSA-V6R4-35F9-9RPWVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse CVE-2025-6014 · GHSA-QV3P-FMV3-9HWWVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersCVE-2025-6011 · GHSA-MWGR-84FV-3JH9Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| HashiCorp Vault ldap auth method may not have correctly enforced MFACVE-2025-6013 · GHSA-7RX2-769V-HRWFVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Vault Community Edition rekey and recovery key operations can cause denial of serviceCVE-2025-4656 · GHSA-FHC2-8QX8-6VJ7Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| Hashicorp Vault has Incorrect Validation for Non-CA CertificatesCVE-2025-6037 · GHSA-6C5R-4WFC-3MCXVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault has Lockout Feature Authentication BypassCVE-2025-6004 · GHSA-QGJ7-FMQ2-6CC4Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
