| Sensitive headers not cleared on cross-origin redirect in net/httpCVE-2025-4673 · GO-2025-3751 |
stdlibCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| JsBraceDepth Context Tracking Bugs (XSS) in html/templateCVE-2026-32289 · GO-2026-4865 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/appliance |
GoRed Hat |
Medium
|
Fix reported |
|
| Unbounded allocation for old GNU sparse in archive/tarCVE-2026-32288 · GO-2026-4869 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/redhat-user-workloads/assisted-installer-ds-main |
GoRed Hat |
Medium
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Arbitrary inputs are included in errors without any escaping in net/textprotoCVE-2026-42507 · GO-2026-5039 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Unexpected session resumption in crypto/tlsCVE-2025-68121 · GO-2026-4337 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLCVE-2025-27152 · GHSA-JR5F-V2JV-69X6 |
axiosCryostat 3/io.cryostat-cryostat3 |
npmRed Hat |
High
|
Fix reported |
|
| Logrus is vulnerable to DoS when using Entry.Writer()CVE-2025-65637 · GHSA-4F99-4Q7P-P3GHVersion ranges need review. |
github.com/sirupsen/logrusConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2025-5197 · GHSA-9356-575X-2W9MVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 |
tmpCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| Starlette has possible denial-of-service vector when parsing large files in multipart formsCVE-2025-54121 · GHSA-2C2J-9GV5-CJ73Version ranges need review. |
starletteOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browserCVE-2025-30360 · GHSA-9JGG-88MC-972H |
webpack-dev-serverCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| on-headers is vulnerable to http response header manipulationCVE-2025-7339 · GHSA-76C9-3JPH-RJ3Q |
on-headersCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| golang.org/x/net vulnerable to Cross-site ScriptingCVE-2025-22872 · GHSA-VVGC-356P-C3XWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| undici Denial of Service attack via bad certificate dataCVE-2025-47279 · GHSA-CXRH-J4JR-QWG3 |
undiciCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| webpack-dev-server users' source code may be stolen when they access a malicious web siteCVE-2025-30359 · GHSA-4V9V-HFQ4-RM2V |
webpack-dev-serverCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| Non-linear parsing of case-insensitive content in golang.org/x/net/htmlCVE-2024-45338 · GHSA-W32M-9786-JP63 |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
High
|
Fix reported |
|
| Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situationsCVE-2024-51744 · GHSA-29WX-VH33-7X7RVersion ranges need review. |
github.com/golang-jwt/jwt/v4Builds for Red Hat OpenShift/openshift-builds-triggers-container |
GoRed Hat |
Low
|
Fix reported |
|
| cookie accepts cookie name, path, and domain with out of bounds charactersCVE-2024-47764 · GHSA-PXG6-PF52-XH8X |
cookieCryostat 3/cookie |
npmRed Hat |
Low
|
Fix reported |
|
