TI-2026-51727 CVE-2026-73643 · GHSA-pm4m-ph32-ghv5
js-yaml: Exponential parsing time in the flow collections leads to denial of service
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:60447
OpenShift Container Platform 4.20.36 security and extras update
Released 2026-09-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9 +1
Fixes 4 records
TI-2026-48532 CVE-2026-69152 · GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Priority HIGH 72
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
TI-2026-12072 CVE-2026-14257 · GHSA-mh99-v99m-4gvg
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Priority MEDIUM 40
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.