| KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumptionCVE-2026-13322 · GHSA-6F2P-2QG2-QQCH |
github.com/kubevirt/kubevirtkubevirt.io/kubevirt |
GoRed Hat |
Low
|
No fix reported |
|
| KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwriteCVE-2026-13218 · GHSA-Q3JC-42CQ-33FJVersion ranges need review. |
kubevirt.io/kubevirtRed Hat OpenShift Virtualization 4/container-native-virtualization/virt-handler-rhel9 |
GoRed Hat |
Medium
|
No fix reported |
|
| ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReaderCVE-2026-10722 · GHSA-XHGW-QWWF-PG32Version ranges need review. |
github.com/cilium/ebpfConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| KubeVirt Arbitrary Container File Read CVE-2025-64433 · GHSA-QW6Q-3PGR-5CWQVersion ranges need review. |
kubevirt.io/kubevirtRed Hat OpenShift Virtualization 4/container-native-virtualization/kubemacpool-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/cryptoCVE-2024-45337 · GHSA-V778-237X-GJRCVersion ranges need review. |
golang.org/x/cryptoBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel8 |
GoRed Hat |
Critical
|
Fix reported |
|
| golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| Logrus is vulnerable to DoS when using Entry.Writer()CVE-2025-65637 · GHSA-4F99-4Q7P-P3GHVersion ranges need review. |
github.com/sirupsen/logrusConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between NodesCVE-2025-64436 · GHSA-7XGM-5PRM-V5GC |
github.com/kubevirt/kubevirtkubevirt.io/kubevirt |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds readCVE-2025-47914 · GHSA-F6X5-JH6R-WRFVVersion ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumptionCVE-2025-58181 · GHSA-J5W8-Q4QC-RX2XVersion ranges need review. |
golang.org/x/cryptoBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer CVE-2025-64432 · GHSA-38JW-G2QX-4286Version ranges need review. |
kubevirt.io/kubevirtRed Hat OpenShift Virtualization 4/container-native-virtualization/kubemacpool-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| KubeVirt VMI Denial-of-Service (DoS) Using Pod ImpersonationCVE-2025-64435 · GHSA-9M94-W2VQ-HCF9Version ranges need review. |
kubevirt.io/kubevirtRed Hat OpenShift Virtualization 4/container-native-virtualization/kubemacpool-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission ChangesCVE-2025-64437 · GHSA-2R4R-5X78-MVQFVersion ranges need review. |
kubevirt.io/kubevirtRed Hat OpenShift Virtualization 4/container-native-virtualization/kubemacpool-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| runc vulnerable to container breakout through process.cwd trickery and leaked fdsCVE-2024-21626 · GHSA-XR7R-F8XQ-VFVVVersion ranges need review. |
github.com/opencontainers/runcOpenShift Developer Tools and Services/ocp-tools-4/jenkins-agent-base-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Panic on certain certificates in crypto/tlsCVE-2021-34558 · GO-2021-0243 |
stdlibOpenShift Pipelines/golang |
GoRed Hat |
Medium
|
Fix reported |
|
| Panic in ReverseProxy in net/http/httputilCVE-2021-36221 · GO-2021-0245 |
stdlibOpenShift Serverless/knative-eventing |
GoRed Hat |
Medium
|
Fix reported |
|
| Stack exhaustion when compiling deeply nested expressions in regexpCVE-2022-24921 · GO-2021-0347 |
stdlibMigration Toolkit for Containers/cpma |
GoRed Hat |
Medium
|
Fix reported |
|
| golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octetCVE-2021-29923 |
Migration Toolkit for Containers/rhmtc/openshift-migration-must-gather-rhel8Migration Toolkit for Containers/rhmtc/openshift-migration-registry-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| istio: Istio: Firewall rule injection via annotation allows limited integrity impactCVE-2026-23766 |
ExternalDNS Operator/edo/external-dns-rhel8ExternalDNS Operator/edo/external-dns-rhel9 |
Red Hat |
Unknown
|
No fix reported |
|
| kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts VMI identity from unauthenticated gRPC request bodyCVE-2026-13208 |
Red Hat OpenShift Virtualization 4/container-native-virtualization/virt-handler-rhel9Red Hat OpenShift Virtualization 4/container-native-virtualization/virt-handler |
Red Hat |
Medium
|
No fix reported |
|
