TI-2026-21593 CVE-2026-27143 · GHSA-cfp9-33rc-j74f
Missing bound checks can lead to memory corruption in safe Go in cmd/compile
Priority MEDIUM 50
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow.
RHSA-2026:34099
OpenShift Container Platform 4.17.55 bug fix and security update
Released 2026-07-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
Fixes 8 records
TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2026-27599 CVE-2026-35469 · GHSA-pc3f-x583-g7j2
SpdyStream: DOS on CRI
Priority MEDIUM 45
spdystream is a Go library for multiplexing streams over SPDY connections.
TI-2026-21590 CVE-2026-27140 · GHSA-5w89-2c2x-6x66
Code execution vulnerability in SWIG code generation in cmd/go
Priority MEDIUM 41
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-26368 CVE-2026-34043 · GHSA-qj8w-gfj5-8c6v
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
Priority LOW 33
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
TI-2026-21594 CVE-2026-27144 · GHSA-cqrx-3m42-5p5w
Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
Priority LOW 31
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading…