| Quadratic complexity in WordDecoder.DecodeHeader in mimeCVE-2026-42504 · GO-2026-5038 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Incorrect parsing of IPv6 host literals in net/urlCVE-2026-25679 · GO-2026-4601 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821 · GO-2026-5026 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Sensitive headers not cleared on cross-origin redirect in net/httpCVE-2025-4673 · GO-2025-3751 |
stdlibCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSONCVE-2024-24786 · GHSA-8R3F-844C-MC37Version ranges need review. |
google.golang.org/protobuf/encoding/protojsongoogle.golang.org/protobuf/internal/encoding/json |
GoRed Hat |
Medium
|
Fix reported |
|
| JsBraceDepth Context Tracking Bugs (XSS) in html/templateCVE-2026-32289 · GO-2026-4865 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/appliance |
GoRed Hat |
Medium
|
Fix reported |
|
| Quadratic string concatenation in consumePhrase in net/mailCVE-2026-42499 · GO-2026-4977 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Unbounded allocation for old GNU sparse in archive/tarCVE-2026-32288 · GO-2026-4869 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/assisted-installer-ds-main |
GoRed Hat |
Medium
|
Fix reported |
|
| Quadratic string concatentation in consumeComment in net/mailCVE-2026-39820 · GO-2026-4986 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283 · GO-2026-4870 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Unexpected work during chain building in crypto/x509CVE-2026-32280 · GO-2026-4947 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Inefficient policy validation in crypto/x509CVE-2026-32281 · GO-2026-4946 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/appliance |
GoRed Hat |
Medium
|
Fix reported |
|
| Arbitrary inputs are included in errors without any escaping in net/textprotoCVE-2026-42507 · GO-2026-5039 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Invoking Encrypted Client Hello privacy leak in crypto/tlsCVE-2026-42505 · GO-2026-5856 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Unbounded allocation when parsing GNU sparse map in archive/tarCVE-2025-58183 · GO-2025-4014 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Crash when handling long CNAME response in netCVE-2026-33811 · GO-2026-4981 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responsesCVE-2026-39830 · GHSA-VGWF-H737-FF37Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502 · GO-2026-5027 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flowCVE-2026-39835 · GHSA-78MQ-XCR3-XM33Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
