TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:54602
OpenShift Container Platform 4.21.29 bug fix and security update
Released 2026-08-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-haproxy-router-rhel9 +6
Fixes 11 records
TI-2026-30782 CVE-2026-42499 · GHSA-xq5j-9r39-c3vf
Quadratic string concatenation in consumePhrase in net/mail
Priority MEDIUM 40
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
TI-2026-28702 CVE-2026-39820 · GHSA-p9h5-jm8x-mjm5
Quadratic string concatentation in consumeComment in net/mail
Priority MEDIUM 40
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478
Crash when handling long CNAME response in net
Priority MEDIUM 40
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-31149 CVE-2026-42965 · GHSA-76ww-43j5-78x5
Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation
Priority LOW 34
A flaw was found in the OpenShift Router.
TI-2026-36990 CVE-2026-50237 · GHSA-5mvj-m7fw-m49w
Server-side request forgery in Red Hat OpenShift Container Platform 4.12
Priority LOW 33
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy.
TI-2026-36989 CVE-2026-50236 · GHSA-c4v8-c9cj-xrmr
Server-side request forgery in Red Hat OpenShift Container Platform 4.14
Priority LOW 33
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers.
TI-2026-32788 CVE-2026-44918 · GHSA-q458-5jc4-vvpg
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
Priority LOW 25
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
TI-2026-12143 CVE-2026-14362 · GHSA-6r3r-6rpf-v429
Denial of service via crafted push/pull gossip message in memberlist
Priority LOW 22
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node…