TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
RHSA-2026:72849
multicluster engine for Kubernetes v2.17.3 security update
Released 2026-09-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
Fixes 9 records
TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
TI-2026-51612 CVE-2026-73500 · GHSA-6vch-q96h-7gc3
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
Priority MEDIUM 44
etcd is a distributed key-value store for the data of a distributed system.
TI-2026-53157 CVE-2026-75931 · GHSA-5jgf-p345-68v8
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Priority LOW 39
fast-uri is a URI parser for Node.js.
TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r
Infinite loop on invalid input in golang.org/x/text
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
TI-2026-53285 CVE-2026-76172 · GHSA-jqff-g426-hqxp
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-53188 CVE-2026-75975 · GHSA-f65p-4m7j-42xc
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-53132 CVE-2026-75899 · GHSA-fph4-wmhf-6fwf
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-60056 CVE-2026-88031 · GHSA-gf3f-xg7m-h8wp
GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
Priority LOW 28
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a…