TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:73853
OpenShift Container Platform 4.16.72 bug fix and security update
Released 2026-10-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +17
Fixes 9 records
TI-2026-28714 CVE-2026-39832 · GHSA-f5wc-c3c7-36mc
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
Priority MEDIUM 48
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.
TI-2026-28713 CVE-2026-39831 · GHSA-89gr-r52h-f8rx
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
Priority MEDIUM 48
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.
TI-2026-53121 CVE-2026-75885 · GHSA-hm52-6738-r26p
Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint
Priority MEDIUM 47
A flaw was found in the OpenShift console.
TI-2026-28712 CVE-2026-39830 · GHSA-vgwf-h737-ff37
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
Priority MEDIUM 46
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
TI-2026-53123 CVE-2026-75887 · GHSA-v74g-7mx6-787p
Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler
Priority LOW 39
A flaw was found in the OpenShift console.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-28711 CVE-2026-39829 · GHSA-w879-237q-wc7r
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.