TI-2026-57986 CVE-2026-84375 · GHSA-2883-xcg3-v3hh
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Priority MEDIUM 40
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:79040
OpenShift Container Platform 4.18.57 security and extras update
Released 2026-10-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator
Fixes 4 records
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
TI-2026-58005 CVE-2026-84394 · GHSA-58mr-gqgx-xq4g
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
Priority LOW 39
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.
TI-2026-57933 CVE-2026-84292 · GHSA-qw65-cvwx-89v3
fast-uri vulnerable to authority injection via an unvalidated port in serialize
Priority LOW 38
fast-uri serializes the port component of a URI without validating it.