| Requests vulnerable to .netrc credentials leak via malicious URLsCVE-2024-47081 · GHSA-9HJG-9R4M-MVJ7Version ranges need review. |
requestsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Multiple issues involving quote API in shlexCVE-2024-58266 · GHSA-R7QV-8R2H-PG27Version ranges need review. |
shlexLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502 · GO-2026-5027 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| BuildKit has a possible runtime DoS via unbounded group parsingCVE-2026-61712 · GHSA-72X6-4J93-7W86Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| BuildKit: Custom frontend could bypass Seccomp/AppArmorCVE-2026-61711 · GHSA-7236-3392-C5C6Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| opentelemetry-go's baggage parsing no longer caps raw header lengthCVE-2026-41178 · GHSA-5WRP-CWCJ-Q835 |
go.opentelemetry.io/otel/baggagego.opentelemetry.io/otel/propagation |
GoRed Hat |
Medium
|
Fix reported |
|
| Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dotsCVE-2026-39350 · GHSA-9GCG-W975-3RJHVersion ranges need review. |
istio.io/istioOpenShift Service Mesh 3/openshift-service-mesh/istio-proxyv2-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Go Net HTML parser is vulnerable to denial of serviceCVE-2026-25680 · GHSA-5CV4-JP36-H3MWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Istio: SSRF via RequestAuthentication jwksUriCVE-2026-41413 · GHSA-FGW5-HP8F-XFHCVersion ranges need review. |
istio.io/istioOpenShift Service Mesh 3/openshift-service-mesh/istio-proxyv2-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| filelock has a TOCTOU race condition which allows symlink attacks during lock file creationCVE-2025-68146 · GHSA-W853-JP5J-5J7FVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| quic-go HTTP/3 QPACK Header Expansion DoSCVE-2025-64702 · GHSA-G754-HX8W-X2G6Version ranges need review. |
github.com/quic-go/quic-goCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| body-parser is vulnerable to denial of service when url encoding is usedCVE-2025-13466 · GHSA-WQCH-XFXH-VRR4 |
body-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| node-forge is vulnerable to ASN.1 OID Integer TruncationCVE-2025-66030 · GHSA-65CH-62R8-G69G |
node-forgeCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| Vite middleware may serve files starting with the same name with the public directoryCVE-2025-58751 · GHSA-G4JQ-H2W9-997C |
viteCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. |
pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputsCVE-2025-48924 · GHSA-J288-Q9X7-2F5V |
commons-lang:commons-langorg.apache.commons:commons-lang3 |
MavenRed Hat |
Medium
|
Fix reported |
|
