RHSA-2026:92307

Handlebars provides the power necessary to let users build semantic templates.

Handlebars provides the power necessary to let users build semantic templates.

kin-openapi is a Go project for handling OpenAPI files.

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control.

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making pr…

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other…

gRPC-Go is the Go language implementation of gRPC.

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives.

js-yaml is a JavaScript YAML parser and dumper.

compress provides various compression algorithms.

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

gRPC-Go is the Go language implementation of gRPC.

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595.

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a…

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.