TI-2026-30782 CVE-2026-42499 · GHSA-xq5j-9r39-c3vf
Quadratic string concatenation in consumePhrase in net/mail
Priority MEDIUM 40
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
RHSA-2026:54583
OpenShift Container Platform 4.20.34 bug fix and security update
Released 2026-08-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-haproxy-router-rhel9 +2
Fixes 7 records
TI-2026-28702 CVE-2026-39820 · GHSA-p9h5-jm8x-mjm5
Quadratic string concatentation in consumeComment in net/mail
Priority MEDIUM 40
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
TI-2026-31149 CVE-2026-42965 · GHSA-76ww-43j5-78x5
Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation
Priority LOW 34
A flaw was found in the OpenShift Router.
TI-2026-36990 CVE-2026-50237 · GHSA-5mvj-m7fw-m49w
Server-side request forgery in Red Hat OpenShift Container Platform 4.12
Priority LOW 33
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy.
TI-2026-36989 CVE-2026-50236 · GHSA-c4v8-c9cj-xrmr
Server-side request forgery in Red Hat OpenShift Container Platform 4.14
Priority LOW 33
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers.
TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-32788 CVE-2026-44918 · GHSA-q458-5jc4-vvpg
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
Priority LOW 25
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.