| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceCVE-2026-59885 · GHSA-8PPF-4F7H-5PPJVersion ranges need review. |
pyasn1Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directoryCVE-2026-8643 · GHSA-WF93-45JW-7689Version ranges need review. |
pipExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| containerd CRI checkpoint restore CDI annotation smugglingCVE-2026-53492 · GHSA-33VJ-92QQ-66HCVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
High
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsCVE-2026-59884 · GHSA-M4P7-R5RC-7G4JVersion ranges need review. |
pyasn1Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Arbitrary host CRI log file read via symlink following in CRI checkpoint restoreCVE-2026-53489 · GHSA-RGH6-RFWX-V388Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
High
|
Fix reported |
|
| urllib3: Sensitive headers forwarded across origins in proxied low-level redirectsCVE-2026-44431 · GHSA-QCCP-GFCP-XXVCVersion ranges need review. |
urllib3Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixCVE-2026-45409 · GHSA-65PC-FJ4G-8RJXVersion ranges need review. |
idnaConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip Vulnerable to Inclusion of Functionality from Untrusted Control SphereCVE-2026-6357 · GHSA-JP4C-XJXW-MGF9Version ranges need review. |
pipExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP filesCVE-2026-3219 · GHSA-58QW-9MGM-455VVersion ranges need review. |
pipLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645 · GHSA-GC5V-M9X4-R6X2Version ranges need review. |
requestsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip Path Traversal vulnerabilityCVE-2026-1703 · GHSA-6VGW-5PG2-W6JPVersion ranges need review. |
pipLightspeed Core/lightspeed-core/dataverse-exporter-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpackCVE-2026-24049 · GHSA-8RRH-RW8J-W5FXVersion ranges need review. |
wheelLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
PyPIRed Hat |
High
|
Fix reported |
|
| Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. |
urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. |
pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181 · GHSA-PQ67-6M6Q-MJ2VVersion ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 does not control redirects in browsers and Node.jsCVE-2025-50182 · GHSA-48P4-8XCF-VXJ5Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
