RHSA-2026:60023

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

spdystream is a Go library for multiplexing streams over SPDY connections.

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

A flaw was found in openshift/oauth-proxy.

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy.

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.