RHSA-2026:36625

form-data is a library for creating readable multipart/form-data streams.

JavaScript Cookie is a JavaScript API for handling cookies, client-side.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

containerd is an open-source container runtime.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS).

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.