| dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M |
dnspythonAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| aiohttp: Multiple instances of excessive or unbounded memory/CPU useCVE-2026-123817 · GHSA-2G87-PP6C-29X5 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Paramiko rsakey.py allows the SHA-1 algorithmCVE-2026-44405 · GHSA-R374-RXX8-8654Version ranges need review. |
paramikoMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiCVE-2026-114603 · GHSA-XCQ7-P3PF-P88H |
opentelemetry-apiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-49264 · GHSA-HJ66-6F7G-4R5VVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)CVE-2026-49265 · GHSA-XPV3-W29H-X7CVVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsCVE-2026-63349 · GHSA-3W57-8XMC-8V26Version ranges need review. |
anyioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofingCVE-2026-63374 · GHSA-82R6-8W77-94W6Version ranges need review. |
anyioConfidential Compute Attestation/agent-sandbox/agent-sandbox-router |
PyPIRed Hat |
Critical
|
Fix reported |
|
| AnyIO process-pool workers can block indefinitely on undrained stderrCVE-2026-64847 · GHSA-5P39-CFHJ-2XMPVersion ranges need review. |
anyioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryCVE-2026-97689 · GHSA-VXQ7-64XX-V4GWVersion ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3: HTTPS proxy TLS configuration may be ignored or overriddenCVE-2026-97687 · GHSA-8988-9CW3-XX77Version ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| hpack: Unbounded variable integer decoding can cause run-away computation on malformed inputCVE-2026-59980 · GHSA-8V8H-HG4W-MVQ2Version ranges need review. |
hpackMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| h2: Duplicate Host header could facilitate request smugglingCVE-2026-71554 · GHSA-6HR6-W5QG-QMWGVersion ranges need review. |
h2Migration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Kubernetes GitRepo Volume Inadvertent Local Repository AccessCVE-2025-1767 · GHSA-3WGM-2GW2-VH5MVersion ranges need review. |
k8s.io/kubernetesRed Hat Ansible Automation Platform 2/ansible-automation-platform-25/ee-supported-rhel9 |
GoRed Hat |
Medium
|
No fix reported |
|
| LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoaderCVE-2026-27795 · GHSA-MPHV-75CG-56WG |
@langchain/communityOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Azure Core is vulnerable to deserialization of untrusted dataCVE-2026-21226 · GHSA-JM66-CG57-JJV5Version ranges need review. |
azure-coreConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockCVE-2026-22701 · GHSA-QMGC-5H2G-MVRWVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP Vulnerable to Cookie Parser Warning StormCVE-2025-69230 · GHSA-FH55-R93G-J68GVersion ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
