TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:54274
Red Hat OpenShift Workload Availability Operator v0.8.1 security update
Released 2026-08-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Workload Availability 0.8 registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator
Fixes 9 records
TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
TI-2026-30782 CVE-2026-42499 · GHSA-xq5j-9r39-c3vf
Quadratic string concatenation in consumePhrase in net/mail
Priority MEDIUM 40
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
TI-2026-28702 CVE-2026-39820 · GHSA-p9h5-jm8x-mjm5
Quadratic string concatentation in consumeComment in net/mail
Priority MEDIUM 40
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478
Crash when handling long CNAME response in net
Priority MEDIUM 40
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
TI-2026-28762 CVE-2026-39883 · GHSA-hfvc-g4fc-pqhx
Untrusted search path in open-telemetry opentelemetry-go
Priority LOW 34
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.