| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| Enforce maximum recursion depth in encoding/asn1CVE-2026-33818 · GO-2026-5972 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821 · GO-2026-5026 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Prevent DoS on deadlocked established channel in golang.org/x/crypto/sshCVE-2026-56855 · GO-2026-6355 |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Infinite loop on invalid input in golang.org/x/textCVE-2026-56852 · GO-2026-5970 |
golang.org/x/textAWS Load Balancer Operator/albo/aws-load-balancer-rhel9-operator |
GoRed Hat |
High
|
Fix reported |
|
| Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502 · GO-2026-5027 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flowCVE-2026-39835 · GHSA-78MQ-XCR3-XM33Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto vulnerable to infinite loop on large channel writesCVE-2026-39834 · GHSA-RM3J-F69W-WQMQVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlCVE-2026-27136 · GO-2026-5030 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoSCVE-2026-39827 · GHSA-QPW4-5X99-6VJPVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassedCVE-2026-39831 · GHSA-89GR-R52H-F8RXVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| golang.org/x/crypto: Invoking byte arithmetic causes underflow and panicCVE-2026-46597 · GHSA-Q4H4-GMJ2-QVW2Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto vulnerable to invoking bypass of certificate restrictionsCVE-2026-39828 · GHSA-45GG-VH54-H5M9Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| opentelemetry-go's baggage parsing no longer caps raw header lengthCVE-2026-41178 · GHSA-5WRP-CWCJ-Q835 |
go.opentelemetry.io/otel/baggagego.opentelemetry.io/otel/propagation |
GoRed Hat |
Medium
|
Fix reported |
|
| SpdyStream: DOS on CRICVE-2026-35469 · GHSA-PC3F-X583-G7J2Version ranges need review. |
github.com/moby/spdystreamDynamic Accelerator Slicer Operator for Red Hat OpenShift/dynamic-accelerator-slicer-tech-preview/instaslice-daemonset-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Go Net HTML parser is vulnerable to denial of serviceCVE-2026-25680 · GHSA-5CV4-JP36-H3MWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds readCVE-2025-47914 · GHSA-F6X5-JH6R-WRFVVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumptionCVE-2025-58181 · GHSA-J5W8-Q4QC-RX2XVersion ranges need review. |
golang.org/x/cryptoBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
