TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
RHSA-2026:71454
OpenShift Container Platform 4.22.16 bug fix and security update
Released 2026-09-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-node-termination-handler-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-rhel9-operator +8
Fixes 9 records
TI-2026-53121 CVE-2026-75885 · GHSA-hm52-6738-r26p
Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint
Priority MEDIUM 47
A flaw was found in the OpenShift console.
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
TI-2026-53123 CVE-2026-75887 · GHSA-v74g-7mx6-787p
Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler
Priority LOW 39
A flaw was found in the OpenShift console.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-15158 CVE-2026-18446 · GHSA-7p8r-x3mc-p8w7
fast-uri vulnerable to host confusion via backslash authority introducer
Priority LOW 39
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backs…
TI-2026-53122 CVE-2026-75886 · GHSA-f8rq-4f8p-cmww
Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster…
Priority LOW 38
A flaw was found in openshift/console.
TI-2026-33551 CVE-2026-45819 · GHSA-w5vr-8v7q-w6rv
Improper handling of exceptional conditions in web-platform-dx baseline-browser-mapping
Priority LOW 36
baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.