| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| go-git missing validation decoding Index v4 files leads to panicCVE-2026-33762 · GHSA-GM2X-2G9H-CCM8بازه‌ها نیاز به بررسی دارند. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
کم
|
اصلاح گزارش شده |
|
| Buildah allows arbitrary directory mountCVE-2024-9675 · GHSA-586P-749J-FHWPبازه‌ها نیاز به بررسی دارند. |
github.com/containers/buildahOpenShift Developer Tools and Services/ocp-tools-4/jenkins-agent-base-rhel8 |
GoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocationCVE-2026-102554 · GHSA-XXPH-C9WW-HJ94 |
com.google.guava:guavaExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Incorrect parsing of IPv6 host literals in net/urlCVE-2026-25679 · GO-2026-4601 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810 · GO-2026-4866 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local userCVE-2026-106451 · GHSA-MCR4-QMVW-PX4G |
at.yawk.lz4:lz4-javaorg.lz4:lz4-java |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsCVE-2026-106450 · GHSA-GM45-99XC-R7WV |
at.yawk.lz4:lz4-javaorg.lz4:lz4-java |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErrorCVE-2026-106453 · GHSA-6CX8-RJF8-PR8G |
at.yawk.lz4:lz4-javaorg.lz4:lz4-java |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headerCVE-2026-106452 · GHSA-4V53-57PG-C464 |
at.yawk.lz4:lz4-javaorg.lz4:lz4-java |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Incorrect enforcement of email constraints in crypto/x509CVE-2026-27137 · GO-2026-4599 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283 · GO-2026-4870 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Unexpected work during chain building in crypto/x509CVE-2026-32280 · GO-2026-4947 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Unbounded allocation when parsing GNU sparse map in archive/tarCVE-2025-58183 · GO-2025-4014 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| HTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325 · GHSA-4374-P667-P6C8بازه‌ها نیاز به بررسی دارند. |
golang.org/x/netstdlib |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
