Red Hat OpenShift Container Platform 5/openshift5/ose-helm-rhel9-operator

Red Hat · Package

9 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8	github.com/klauspost/compress/zstd github.com/klauspost/compress	GoRed Hat	High	Fix reported	2026-11-06
github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review.	github.com/moby/sys/user Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9	GoRed Hat	Medium	Fix reported	2026-10-20
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81872 · GHSA-HJF4-FPHR-2H65Version ranges need review.	go.opentelemetry.io/otel/sdk/log Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9	GoRed Hat	Medium	Fix reported	2026-10-02
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81871 · GHSA-W34Q-CM8F-9C5XVersion ranges need review.	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9	GoRed Hat	Medium	Fix reported	2026-09-28
containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review.	github.com/containerd/containerd/v2 github.com/containerd/containerd	GoRed Hat	Medium	Fix reported	2026-09-17
Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review.	github.com/docker/docker github.com/moby/moby/v2	GoRed Hat	Medium	Fix reported	2026-09-10
go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557 · GHSA-QGQ7-7HM3-Q39JVersion ranges need review.	github.com/go-git/go-git/v5 github.com/go-git/go-git/v6	GoRed Hat	Medium	Fix reported	2026-09-10
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token LeakageCVE-2026-49478 · GHSA-F5MR-Q85P-6HH6Version ranges need review.	github.com/sigstore/fulcio Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9	GoRed Hat	High	Fix reported	2026-09-10
podman: Goroutine/file-descriptor leak in storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer on malformed layersCVE-2026-114236	Confidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 DPU kit for NVIDIA/dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10	Red Hat	Low	No fix reported	Not recorded