| Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli packageCVE-2026-111497 · GHSA-9V8H-QQGM-4M35Version ranges need review. |
github.com/andybalholm/brotlibrotli |
GoPyPIRed Hat |
Critical
|
Fix reported |
|
| Podman: WORKDIR symlink traversal vulnerabilityCVE-2026-55686 · GHSA-Q6R4-3WMG-FWCQVersion ranges need review. |
github.com/containers/podman/v2github.com/containers/podman/v3 |
GoRed Hat |
Medium
|
Fix reported |
|
| Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotationCVE-2026-94603 · GHSA-2CVF-WQM6-WR9GVersion ranges need review. |
github.com/containers/podman/v2github.com/containers/podman/v3 |
GoRed Hat |
Critical
|
Fix reported |
|
| Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunksCVE-2026-115927 · GHSA-R4J5-9XPP-3985 |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingCVE-2026-116577 · GHSA-PCG2-G6CJ-Q92C |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tornado: Open redirect in RedirectHandler via protocol-relative URLsCVE-2026-116578 · GHSA-PW9P-V7R6-GX4P |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Podman: Malformed Image can trick podman run into leaking host environment variables into the containerCVE-2026-57231 · GHSA-4HQ8-GPF5-8P68Version ranges need review. |
github.com/containers/libpodgithub.com/containers/podman/v2 |
GoRed Hat |
High
|
Fix reported |
|
| Tornado has a CRLF injection in CurlAsyncHTTPClient headersCVE-2024-58384 · GHSA-W235-7P84-XX57 |
tornadoExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)CVE-2026-91990 · GHSA-8423-8FGW-73VQ |
tornadoExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuseCVE-2026-91992 · GHSA-PW6J-QG29-8W7F |
tornadoExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`CVE-2026-91991 · GHSA-WWV5-G3V4-889X |
tornadoExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loopCVE-2026-82397 · GHSA-MPF4-983Q-P7J4Version ranges need review. |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pip would incorrectly handle doubly-encoded package URLs from indexesCVE-2026-13346 · GHSA-QWM4-QH6W-59XRVersion ranges need review. |
pipRed Hat Enterprise Linux 10/python-pip |
PyPIRed Hat |
Medium
|
Fix reported |
|
| node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionCVE-2026-73566 · GHSA-R292-9MHP-454M |
tarCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations CVE-2026-41579 · GHSA-XJVP-4FHW-GC47Version ranges need review. |
github.com/opencontainers/runcRed Hat Enterprise Linux 8/container-tools:rhel8/runc |
GoRed Hat |
Medium
|
Fix reported |
|
| node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsCVE-2026-59875 · GHSA-GVWX-54WH-QM9J |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| Tornado has out-of-bounds memory access via C extensionCVE-2026-49854 · GHSA-CX3H-4QPV-8HC9Version ranges need review. |
tornadoExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixCVE-2026-45409 · GHSA-65PC-FJ4G-8RJXVersion ranges need review. |
idnaConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
