| dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M |
dnspythonAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT: PyJWKClient follows redirects when fetching JWKSCVE-2026-102267 · GHSA-9V7F-9G4P-FFGJVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patternsCVE-2026-86000 · GHSA-GJV8-XP57-G29CVersion ranges need review. |
soupsieveExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)CVE-2026-85999 · GHSA-J934-XHV5-FG8FVersion ranges need review. |
soupsieveExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryCVE-2026-97689 · GHSA-VXQ7-64XX-V4GWVersion ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3: HTTPS proxy TLS configuration may be ignored or overriddenCVE-2026-97687 · GHSA-8988-9CW3-XX77Version ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardCVE-2026-102268 · GHSA-FFC3-869F-JXW9Version ranges need review. |
pyjwtLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Critical
|
Fix reported |
|
| WebOb: Open redirect in Location header normalization via leading C0 control / space charactersCVE-2026-54770 · GHSA-6HX8-3WJJ-GR8GVersion ranges need review. |
webobRed Hat Ceph Storage 4/python-webob |
PyPIRed Hat |
Medium
|
Fix reported |
|
| sqlparse: Quadratic O(n²) DoS in group_commentsCVE-2026-71491 · GHSA-F2FF-P2WW-7P4PVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesCVE-2026-59894 · GHSA-3496-9G83-7V6XVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. |
pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributesCVE-2026-49825 · GHSA-4JHM-JV67-739FVersion ranges need review. |
lxml-html-cleanLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| ironic-image: Unauthenticated local access to Ironic APICVE-2024-31463 |
Red Hat OpenShift Container Platform 4/openshift4/ose-ironic-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| keystonemiddleware: keystonemiddleware: application credential access_rules bypass via X-Service-Token header presence checkCVE-2026-115642 |
Red Hat OpenShift Container Platform 4/openshift4/ose-ironic-rhel9Red Hat OpenShift Container Platform 4/python-keystonemiddleware |
Red Hat |
High
|
No fix reported |
|
| ironic: OpenStack Ironic: Information disclosure via crafted requestCVE-2026-71201 |
Red Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel8-operatorRed Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel9-operator |
Red Hat |
Medium
|
No fix reported |
|
| ironic: OpenStack Ironic: Autodetect deploy interface fails to run cleaningCVE-2026-74250 |
Red Hat OpenShift Container Platform 4/openshift4/ose-ironic-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| ironic: OpenStack Ironic: Information disclosure via unexpected credential transmissionCVE-2026-90461 |
Red Hat OpenShift Container Platform 4/openshift4/ose-ironic-rhel9Red Hat OpenShift Container Platform 4/openstack-ironic |
Red Hat |
Medium
|
No fix reported |
|
| scp: scp.py: Arbitrary file overwrite via path traversalCVE-2026-109152 |
Confidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9Migration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| openstack-ironic: openstack-ironic: maintenance state update bypasses set_maintenance policy via generic PATCHCVE-2026-89419 |
Red Hat OpenShift Container Platform 4/openshift4/ose-ironic-rhel9Red Hat OpenShift Container Platform 4/openstack-ironic |
Red Hat |
Medium
|
No fix reported |
|
