| Requests vulnerable to .netrc credentials leak via malicious URLsCVE-2024-47081 · GHSA-9HJG-9R4M-MVJ7Version ranges need review. |
requestsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responsesCVE-2026-39830 · GHSA-VGWF-H737-FF37Version ranges need review. |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| aiohttp allows unlimited trailer headers, leading to possible uncapped memory usageCVE-2026-22815 · GHSA-W2FM-2CPV-W7V5Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP has a Multipart Header Size BypassCVE-2026-34516 · GHSA-M5QP-6W8W-W647Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnectorCVE-2026-34513 · GHSA-HCC4-C3V8-RX92Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirectCVE-2026-34518 · GHSA-966J-VMVW-G2G9Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP accepts duplicate Host headersCVE-2026-34525 · GHSA-C427-H43C-VF67Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
Medium
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| path-to-regexp contains a ReDoSCVE-2024-52798 · GHSA-RHX6-C78J-4Q9W |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| AIOHTTP has HTTP response splitting via \r in reason phraseCVE-2026-34519 · GHSA-MWH4-6H8G-PG8WVersion ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypassCVE-2026-34520 · GHSA-63HF-3VF5-4WQFVersion ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP has CRLF injection through multipart part content type header constructionCVE-2026-34514 · GHSA-2VRM-GR82-F7M5Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP has late size enforcement for non-file multipart fields causes memory DoSCVE-2026-34517 · GHSA-3WQ7-RQQ7-WX6JVersion ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2026-0540 · GHSA-V2WJ-7WPQ-C8VV |
dompurifyCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2025-15599 · GHSA-V8JM-5VWX-CFXM |
dompurifyCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645 · GHSA-GC5V-M9X4-R6X2Version ranges need review. |
requestsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Black: Arbitrary file writes from unsanitized user input in cache file nameCVE-2026-32274 · GHSA-3936-CMFR-PM3MVersion ranges need review. |
blackOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| chi has an open redirect vulnerability in the RedirectSlashes middlewareCVE-2025-69725 · GHSA-MQQF-5WVP-8FH8Version ranges need review. |
github.com/go-chi/chi/v2github.com/go-chi/chi/v3 |
GoRed Hat |
Medium
|
Fix reported |
|
| filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockCVE-2026-22701 · GHSA-QMGC-5H2G-MVRWVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
