TI-2026-25384 CVE-2026-32936 · GHSA-63cw-r7xf-jmwr
CoreDNS DoH GET path missing size validation causes CPU and memory amplification
Priority HIGH 77
CoreDNS is a DNS server that chains plugins.
RHSA-2026:25127
Submariner v0.21 security fixes and container updates
Released 2026-06-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/nettest-rhel9 +5
Fixes 15 records
TI-2026-27682 CVE-2026-35579 · GHSA-vp29-5652-4fw9
CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
Priority HIGH 75
CoreDNS is a DNS server written in Go.
TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm
Unexpected session resumption in crypto/tls
Priority MEDIUM 51
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…
TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4
Memory exhaustion in query parameter parsing in net/url
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
TI-2026-21032 CVE-2026-26018 · GHSA-h75p-j8xm-m278
CoreDNS Loop Detection Denial of Service Vulnerability
Priority MEDIUM 41
CoreDNS is a DNS server that chains plugins.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-24809 CVE-2026-32280 · GHSA-m4pr-4j3g-9v7v
Unexpected work during chain building in crypto/x509
Priority MEDIUM 40
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.
TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
TI-2025-41731 CVE-2025-68151 · GHSA-527x-5wrf-22m2
CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages
Priority LOW 36
CoreDNS is a DNS server that chains plugins.
TI-2024-16849 CVE-2024-25621 · GHSA-pwhc-rpq9-4c8w
containerd affected by a local privilege escalation via wide permissions on CRI directory
Priority LOW 35
containerd is an open-source container runtime.
TI-2026-21031 CVE-2026-26017 · GHSA-c9v3-4pv7-87pr
CoreDNS ACL Bypass
Priority LOW 34
CoreDNS is a DNS server that chains plugins.
TI-2025-38131 CVE-2025-61729 · GHSA-7c64-f9jr-v9h2
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
TI-2025-38130 CVE-2025-61728 · GHSA-g9q4-qjx4-2v7q
Excessive CPU consumption when building archive index in archive/zip
Priority LOW 30
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.