TI-2026-21593 CVE-2026-27143 · GHSA-cfp9-33rc-j74f
Missing bound checks can lead to memory corruption in safe Go in cmd/compile
Priority MEDIUM 50
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow.
RHSA-2026:11688
Red Hat OpenShift Service Mesh 2.6.15
Released 2026-04-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/istio-cni-rhel8, registry.redhat.io/openshift-service-mesh/istio-rhel8-operator, registry.redhat.io/openshift-service-mesh/pilot-rhel8 +1
Fixes 5 records
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-24809 CVE-2026-32280 · GHSA-m4pr-4j3g-9v7v
Unexpected work during chain building in crypto/x509
Priority MEDIUM 40
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.
TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
TI-2026-21594 CVE-2026-27144 · GHSA-cqrx-3m42-5p5w
Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
Priority LOW 31
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading…