TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:42150
Satellite 6.17.9.1 Async Update
Released 2026-07-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.17 for RHEL 9 python-pulpcore-3.63.21-2.el9pc, python3.11-pulpcore-3.63.21-2.el9pc, yggdrasil-worker-forwarder-0.0.4-1.el9sat
Fixes 6 records
TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
TI-2026-10860 CVE-2026-12701 · GHSA-j5cg-p988-g42q
Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
Priority MEDIUM 41
A path traversal vulnerability was found in pulpcore.
TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478
Crash when handling long CNAME response in net
Priority MEDIUM 40
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r
Inefficient candidate hostname parsing in crypto/x509
Priority LOW 30
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.