TI-2026-42701 CVE-2026-59887 · GHSA-v245-v573-v5vm
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
Priority HIGH 72
linkify-it is a links recognition library with full Unicode support.
RHSA-2026:89839
OpenShift Container Platform 4.14.77 bug fix and security update
Released 2026-10-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
Fixes 6 records
TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
TI-2026-39884 CVE-2026-55204 · GHSA-4vj2-5mvx-3vcc
HAProxy - NULL Pointer Dereference in hpack_dht_insert Function
Priority MEDIUM 44
HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory…
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Priority LOW 32
On most platforms, Go uses the given system root certificates.
TI-2026-12143 CVE-2026-14362 · GHSA-6r3r-6rpf-v429
Denial of service via crafted push/pull gossip message in memberlist
Priority LOW 22
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node…