TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:50843
Logging for Red Hat OpenShift - 6.0.16
Released 2026-08-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
Fixes 10 records
TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9
Quadratic complexity in WordDecoder.DecodeHeader in mime
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
TI-2026-30782 CVE-2026-42499 · GHSA-xq5j-9r39-c3vf
Quadratic string concatenation in consumePhrase in net/mail
Priority MEDIUM 40
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
Priority MEDIUM 40
Prometheus is an open-source monitoring system and time series database.
TI-2026-28702 CVE-2026-39820 · GHSA-p9h5-jm8x-mjm5
Quadratic string concatentation in consumeComment in net/mail
Priority MEDIUM 40
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478
Crash when handling long CNAME response in net
Priority MEDIUM 40
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
TI-2026-30481 CVE-2026-42151 · GHSA-wg65-39gg-5wfj
Prometheus Azure AD remote write OAuth client secret exposed via config API
Priority LOW 39
Prometheus is an open-source monitoring system and time series database.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.