TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9
Quadratic complexity in WordDecoder.DecodeHeader in mime
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
RHSA-2026:57487
OpenShift Container Platform 4.18.54 bug fix and security update
Released 2026-08-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator +2
Fixes 8 records
TI-2026-30782 CVE-2026-42499 · GHSA-xq5j-9r39-c3vf
Quadratic string concatenation in consumePhrase in net/mail
Priority MEDIUM 40
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
TI-2026-28702 CVE-2026-39820 · GHSA-p9h5-jm8x-mjm5
Quadratic string concatentation in consumeComment in net/mail
Priority MEDIUM 40
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2025-12309 CVE-2025-13465 · GHSA-xxjr-mmjv-4gpg
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.
TI-2026-32264 CVE-2026-44293 · GHSA-66ff-xgx4-vchm
protobufjs: Code injection through bytes field defaults in generated toObject code
Priority LOW 36
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-32263 CVE-2026-44292 · GHSA-fx83-v9x8-x52w
protobufjs: Prototype injection in generated message constructors
Priority LOW 30
protobufjs compiles protobuf definitions into JavaScript (JS) functions.