TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
RHSA-2026:72848
multicluster engine for Kubernetes v2.11.7 security update
Released 2026-09-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/azure-service-operator-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +7
Fixes 12 records
TI-2026-28713 CVE-2026-39831 · GHSA-89gr-r52h-f8rx
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
Priority MEDIUM 48
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.
TI-2026-28712 CVE-2026-39830 · GHSA-vgwf-h737-ff37
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
Priority MEDIUM 46
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
TI-2026-51612 CVE-2026-73500 · GHSA-6vch-q96h-7gc3
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
Priority MEDIUM 44
etcd is a distributed key-value store for the data of a distributed system.
TI-2026-53157 CVE-2026-75931 · GHSA-5jgf-p345-68v8
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Priority LOW 39
fast-uri is a URI parser for Node.js.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-53285 CVE-2026-76172 · GHSA-jqff-g426-hqxp
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-53188 CVE-2026-75975 · GHSA-f65p-4m7j-42xc
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-53132 CVE-2026-75899 · GHSA-fph4-wmhf-6fwf
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-40998 CVE-2026-56860 · GHSA-25mv-j2qr-v5jq
Avoid quadratic complexity in resolvePath in net/url
Priority LOW 27
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
TI-2026-40996 CVE-2026-56858 · GHSA-c974-w86c-vpfw
Fix Javascript regexp context tracking in html/template
Priority LOW 27
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.