TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
RHSA-2026:67543
Red Hat Advanced Cluster Management for Kubernetes v2.17.2 security update
Released 2026-09-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +3
Fixes 10 records
TI-2026-53157 CVE-2026-75931 · GHSA-5jgf-p345-68v8
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Priority LOW 39
fast-uri is a URI parser for Node.js.
TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r
Infinite loop on invalid input in golang.org/x/text
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
TI-2026-53285 CVE-2026-76172 · GHSA-jqff-g426-hqxp
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-53188 CVE-2026-75975 · GHSA-f65p-4m7j-42xc
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-53132 CVE-2026-75899 · GHSA-fph4-wmhf-6fwf
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-60358 CVE-2026-89060 · GHSA-39w5-9x42-rwmr
Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in…
Priority LOW 34
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryColl…
TI-2026-47425 CVE-2026-66780 · GHSA-3xmh-phwc-5f4g
Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
Priority LOW 32
A flaw was found in the submariner-operator component.
TI-2026-50128 CVE-2026-71556 · GHSA-hc8v-wwc9-vgxm
go-git: Worktree operations may follow symlinks
Priority LOW 31
go-git is an extensible git implementation library written in pure Go.
TI-2026-33319 CVE-2026-45570 · GHSA-m7cr-m3pv-hgrp
go-git: Improper single-quote escaping in go-git SSH transport
Priority LOW 12
go-git is an extensible git implementation library written in pure Go.