| Distrust compromised intermediate certificates in crypto/x509CVE-2026-111943 · GO-2026-6809 |
rustls-webpkiwebpki-root-certs |
Rust / CargoGoRed Hat |
High
|
Fix reported |
|
| Quadratic complexity in WordDecoder.DecodeHeader in mimeCVE-2026-42504 · GO-2026-5038 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Enforce maximum recursion depth in encoding/asn1CVE-2026-33818 · GO-2026-5972 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| Fix Javascript regexp context tracking in html/templateCVE-2026-56858 · GO-2026-6091 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-controller-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Add recursion depth guard during decode in encoding/xmlCVE-2026-56859 · GO-2026-6088 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| Limit handshake messages we are willing to accept post-handshake in crypto/tlsCVE-2026-56862 · GO-2026-6090 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| Avoid quadratic complexity in resolvePath in net/urlCVE-2026-56860 · GO-2026-6218 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-operator |
GoRed Hat |
High
|
Fix reported |
|
| Incorrect parsing of IPv6 host literals in net/urlCVE-2026-25679 · GO-2026-4601 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814 · GO-2026-4918 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821 · GO-2026-5026 |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| Reset context tracking on consecutive template expressions in html/templateCVE-2026-94448 · GO-2026-6599 |
stdlibOpenShift Developer Tools and Services/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660 · GO-2026-6610 |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP/1 client connection desynchronization after CONNECT rejection in net/httpCVE-2026-56866 · GO-2026-6605 |
stdlibOpenShift Developer Tools and Services/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP/2 server crash due to HPACK encoder race in net/httpCVE-2026-97032 · GO-2026-6617 |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Memory limit bypass when parsing MIME headers in net/textproto, mime/multipartCVE-2026-94440 · GO-2026-6608 |
stdlibOpenShift Developer Tools and Services/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| Double flow control refund on HTTP/2 server streams in net/httpCVE-2026-78663 · GO-2026-6612 |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Lack of limit on size of parsed Range headers in net/httpCVE-2026-78667 · GO-2026-6609 |
stdlibAWS Load Balancer Operator/albo/aws-load-balancer-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| HTTP/2 server memory exhaustion due to Trailer headers in net/httpCVE-2026-78659 · GO-2026-6603 |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpCVE-2026-94439 · GO-2026-6613 |
stdlibOpenShift Developer Tools and Services/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| Root.Mkdir(All) can follow junctions out of the root on Windows in osCVE-2026-56857 · GO-2026-6604 |
stdlibOpenShift Developer Tools and Services/helm |
GoRed Hat |
Low
|
Fix reported |
|
