TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
RHSA-2026:57801
OpenShift Container Platform 4.21.30 bug fix and security update
Released 2026-08-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +2
Fixes 8 records
TI-2026-28713 CVE-2026-39831 · GHSA-89gr-r52h-f8rx
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
Priority MEDIUM 48
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.
TI-2026-28712 CVE-2026-39830 · GHSA-vgwf-h737-ff37
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
Priority MEDIUM 46
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
TI-2026-24812 CVE-2026-32283 · GHSA-jrg3-gfjw-hm96
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
Priority MEDIUM 40
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.
TI-2026-12072 CVE-2026-14257 · GHSA-mh99-v99m-4gvg
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Priority MEDIUM 40
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-31183 CVE-2026-43003 · GHSA-rmxr-45gj-889w
OS command injection in OpenStack ironic-python-agent
Priority LOW 39
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0.
TI-2026-28711 CVE-2026-39829 · GHSA-w879-237q-wc7r
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.