| Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810 · GO-2026-4866 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Incorrect enforcement of email constraints in crypto/x509CVE-2026-27137 · GO-2026-4599 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Inefficient policy validation in crypto/x509CVE-2026-32281 · GO-2026-4946 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/appliance |
GoRed Hat |
Medium
|
Fix reported |
|
| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Excessive memory allocation when decoding malicious SFNT in golang.org/x/imageCVE-2026-33812 · GO-2026-4962 |
golang.org/x/imageCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Go Images vulnerable to an out-of-memory error via a crafted TIFF fileCVE-2026-33809 · GHSA-44P7-9XX4-HF2GVersion ranges need review. |
golang.org/x/imageCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870 · GHSA-QXP5-GWG8-XV66Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Usage of ExtKeyUsageAny disables policy validation in crypto/x509CVE-2025-22874 · GO-2025-3749 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Kratos has a Confused Deputy issueCVE-2026-6993 · GHSA-JJ45-XVQ5-RHH9Version ranges need review. |
github.com/go-kratos/kratos/v2Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
No fix reported |
|
| Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyCVE-2026-53769 · GHSA-PQPW-CVM4-8MV9 |
Red Hat Enterprise Linux 10/golangRed Hat Enterprise Linux 8/go-toolset:rhel8/golang |
Red HatRubyGems |
Medium
|
Fix reported |
|
| Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/imageCVE-2026-33813 · GO-2026-4961 |
golang.org/x/imageOpenShift Serverless/openshift-serverless-1/kn-plugin-event-sender-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Incorrect results returned from Rows.Scan in database/sqlCVE-2025-47907 · GO-2025-3849 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Quadratic complexity when parsing some invalid inputs in encoding/pemCVE-2025-61723 · GO-2025-4009 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| CrossOriginProtection insecure bypass patterns not limited to exact matches in net/httpCVE-2025-47910 · GO-2025-3955 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| ALPN negotiation error contains attacker controlled information in crypto/tlsCVE-2025-58189 · GO-2025-4008 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Excessive CPU consumption in ParseAddress in net/mailCVE-2025-61725 · GO-2025-4006 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Infinite parsing loop in golang.org/x/netCVE-2025-58190 · GO-2026-4441 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| URLs in meta content attribute actions are not escaped in html/templateCVE-2026-27142 · GO-2026-4603 |
stdlibOpenShift Service Mesh 2/openshift-golang-builder-container |
GoRed Hat |
Medium
|
Fix reported |
|
| Panic in name constraint checking for malformed certificates in crypto/x509CVE-2026-27138 · GO-2026-4600 |
stdlibOpenShift Service Mesh 2/openshift-golang-builder-container |
GoRed Hat |
Low
|
Fix reported |
|
| FileInfo can escape from a Root in osCVE-2026-27139 · GO-2026-4602 |
stdlibOpenShift Service Mesh 2/openshift-golang-builder-container |
GoRed Hat |
Low
|
Fix reported |
|
