[red-hat-konflux]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
registry.redhat.io/openshift4/ose-cli-rhel9	stage	digest	ac644e3 → 6d6cb79

---

insights-runtime-extractor: insights-runtime-extractor: Container Escape via Privileged Binary Execution

CVE-2026-104795

More information

Details

The insights-runtime-extractor runs as a privileged DaemonSet (hostPID: true)
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:

1. fork()s a child process
2. setns() into the target container's PID and mount namespaces
3. fchdir() back to an orphaned FD pointing at the extractor's own root
   filesystem (where /crio.sock is hostPath-mounted)
4. Calls only seteuid(target_uid) — changing the effective UID but leaving
   the real UID and saved-set-UID at 0 and retaining the permitted
   capability set
5. The check_no_privileged_perms() guard inspects only the Effective capability
   set (so it passes), and is skipped entirely when the target runs as uid 0
6. The VersionExecutable fingerprint invokes fpr_kind_executable with
   process.command_line[0] — the target's argv[0], read from
   /proc/<pid>/cmdline and fully controlled by the workload
7. fpr_kind_executable calls exec.Command(executable, "--version").Output()
   — executing the workload's own binary inside the workload's mount
   namespace while ruid=0 in the host user namespace

The executed process can call setuid(0) to restore full root with
CAP_SYS_ADMIN, and inherits the orphaned cwd which resolves into the extractor
container's filesystem containing the host CRI-O socket.

Affected Code

1. Insufficient privilege drop (Rust — extractor coordinator)

File: extractor/src/insights_runtime_extractor.rs

// Lines 139-146 — seteuid-only drop, guard skipped for root containers
join_process_namespaces(process.pid)?;
change_dir(current_dir);
switch_user(*process.uid)?;
if *process.uid != 0 {
    perms::check_no_privileged_perms()
        .expect("Must not have privileged permissions to run fingerprints");
}
fingerprint::run_fingerprints(&config, out_dir, &process);

// Lines 182-185 — only effective UID changed; ruid/suid stay 0
fn switch_user(uid: u32) -> Result<(), ScannerError> {
    debug!("... Becoming user: {uid}");
    seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))
}

2. Execution of untrusted binary (Go — fingerprint)

File: fingerprints/pkg/utils/file.go

// Lines 75-80 — executes a path taken verbatim from workload's argv[0]
func GetExecutableVersionOutput(executable string) (string, error) {
    out, err := exec.Command(executable, "--version").Output()
    if err != nil {
        return "", err
    }
    return string(out), nil
}

3. Workload-controlled path forwarded (Rust — version_executable)

File: version_executable.rs

// Lines 29-34 — workload-controlled command_line[0] forwarded to fingerprint
return Some(vec![
    fpr_kind_executable,
    out_dir.to_string(),
    String::from(&process.command_line[0]),
    String::from(&version_executable.runtime_kind_name),
]);

Attack Pattern

Attacker: Any tenant able to schedule a pod (unprivileged, any namespace)
Victim: The node running the insights-runtime-extractor DaemonSet
Trigger: Automatic — the DaemonSet scans all container processes on the node

Attack sequence:

1. Attacker creates a pod whose process name matches a configured
   versioned-executable pattern (node, python, python3, MainThread,
   or contains java)
2. The pod's main binary (at the path matching argv[0]) is a malicious
   executable that calls setuid(0) to restore root
3. When the insights operator triggers a scan, the DaemonSet forks, enters the
   attacker's mount namespace, and executes the attacker's binary with ruid=0
4. The attacker's code regains full root with CAP_SYS_ADMIN in the host user
   namespace
5. The inherited cwd contains the host CRI-O socket → full node compromise

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-104795
• https://bugzilla.redhat.com/show_bug.cgi?id=2543917
• https://www.cve.org/CVERecord?id=CVE-2026-104795
• https://nvd.nist.gov/vuln/detail/CVE-2026-104795

---

crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

CVE-2026-111943

More information

Details

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-111943
• https://bugzilla.redhat.com/show_bug.cgi?id=2556068
• https://access.redhat.com/security/vulnerabilities/RHSB-2026-012
• https://www.cve.org/CVERecord?id=CVE-2026-111943
• https://nvd.nist.gov/vuln/detail/CVE-2026-111943
• https://github.com/golang/go/issues/82345
• https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU
• https://pkg.go.dev/vuln/GO-2026-6809

---

github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

CVE-2026-63209

More information

Details

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads to out-of-bounds memory access, crashing the application and resulting in a Denial of Service (DoS).

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-63209
• https://bugzilla.redhat.com/show_bug.cgi?id=2543236
• https://www.cve.org/CVERecord?id=CVE-2026-63209
• https://nvd.nist.gov/vuln/detail/CVE-2026-63209
• https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536
• https://github.com/klauspost/compress/releases/tag/v1.18.7
• https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw

---

js-yaml: js-yaml: Denial of Service via crafted YAML documents

CVE-2026-59869

More information

Details

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59869
• https://bugzilla.redhat.com/show_bug.cgi?id=2498122
• https://www.cve.org/CVERecord?id=CVE-2026-59869
• https://nvd.nist.gov/vuln/detail/CVE-2026-59869
• https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
• https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
• https://github.com/nodeca/js-yaml/releases/tag/3.15.0
• https://github.com/nodeca/js-yaml/releases/tag/4.3.0
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m

---

fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization

CVE-2026-84292

More information

Details

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-84292
• https://bugzilla.redhat.com/show_bug.cgi?id=2527747
• https://www.cve.org/CVERecord?id=CVE-2026-84292
• https://nvd.nist.gov/vuln/detail/CVE-2026-84292
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3

---

hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates

CVE-2026-16242

More information

Details

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.

Severity

Critical

References

• https://access.redhat.com/security/cve/CVE-2026-16242
• https://bugzilla.redhat.com/show_bug.cgi?id=2502690
• https://www.cve.org/CVERecord?id=CVE-2026-16242
• https://nvd.nist.gov/vuln/detail/CVE-2026-16242
• https://github.com/openshift/hypershift/pull/9031

---

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

CVE-2026-49978

More information

Details

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.

Severity

Critical

References

• https://access.redhat.com/security/cve/CVE-2026-49978
• https://bugzilla.redhat.com/show_bug.cgi?id=2500695
• https://www.cve.org/CVERecord?id=CVE-2026-49978
• https://nvd.nist.gov/vuln/detail/CVE-2026-49978
• https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff
• https://github.com/cure53/DOMPurify/releases/tag/3.4.7
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq

---

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

CVE-2026-49978

More information

Details

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-49978
• https://bugzilla.redhat.com/show_bug.cgi?id=2500695
• https://www.cve.org/CVERecord?id=CVE-2026-49978
• https://nvd.nist.gov/vuln/detail/CVE-2026-49978
• https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff
• https://github.com/cure53/DOMPurify/releases/tag/3.4.7
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq

---

tar: node-tar: Denial of Service via crafted gzip bomb

CVE-2026-59873

More information

Details

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59873
• https://bugzilla.redhat.com/show_bug.cgi?id=2498120
• https://www.cve.org/CVERecord?id=CVE-2026-59873
• https://nvd.nist.gov/vuln/detail/CVE-2026-59873
• https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3
• https://github.com/isaacs/node-tar/releases/tag/v7.5.19
• https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw

---

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

CVE-2026-45623

More information

Details

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-45623
• https://bugzilla.redhat.com/show_bug.cgi?id=2507595
• https://www.cve.org/CVERecord?id=CVE-2026-45623
• https://nvd.nist.gov/vuln/detail/CVE-2026-45623
• https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q

---

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

CVE-2026-54272

More information

Details

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassification to bypass network restrictions and potentially access or manipulate internal resources. This vulnerability can be exploited on any dual-stack host for IPv4-mapped addresses, and for NAT64, it requires a NAT64/DNS64 gateway in the deployment network.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-54272
• https://bugzilla.redhat.com/show_bug.cgi?id=2507593
• https://www.cve.org/CVERecord?id=CVE-2026-54272
• https://nvd.nist.gov/vuln/detail/CVE-2026-54272
• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg

---

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

CVE-2026-69153

More information

Details

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-69153
• https://bugzilla.redhat.com/show_bug.cgi?id=2510719
• https://www.cve.org/CVERecord?id=CVE-2026-69153
• https://nvd.nist.gov/vuln/detail/CVE-2026-69153
• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
• https://github.com/postcss/postcss/releases/tag/8.5.19
• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp

---

tar: node-tar: Denial of Service via crafted long-path tar archive

CVE-2026-73566

More information

Details

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the filesFilter function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-73566
• https://bugzilla.redhat.com/show_bug.cgi?id=2515509
• https://www.cve.org/CVERecord?id=CVE-2026-73566
• https://nvd.nist.gov/vuln/detail/CVE-2026-73566
• https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a
• https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m

---

github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling

CVE-2026-14362

More information

Details

A flaw was found in HashiCorp memberlist. An attacker with network access to the gossip port could exploit a vulnerability in the push/pull state handling. This could lead to memory exhaustion on a receiving node, causing the process to terminate. This flaw results in a Denial of Service (DoS).

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-14362
• https://bugzilla.redhat.com/show_bug.cgi?id=2498174
• https://www.cve.org/CVERecord?id=CVE-2026-14362
• https://nvd.nist.gov/vuln/detail/CVE-2026-14362
• https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556

---

qs: qs: Denial of Service via improper validation in stringify function

CVE-2026-82417

More information

Details

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then serialized by qs.stringify, triggers a TypeError. This vulnerability can lead to a Denial of Service (DoS), causing affected applications to return a 500 error or, in certain scenarios, terminate the application process.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-82417
• https://bugzilla.redhat.com/show_bug.cgi?id=2525936
• https://www.cve.org/CVERecord?id=CVE-2026-82417
• https://nvd.nist.gov/vuln/detail/CVE-2026-82417
• https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6
• https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g

---

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

CVE-2026-14257

More information

Details

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-14257
• https://bugzilla.redhat.com/show_bug.cgi?id=2506433
• https://www.cve.org/CVERecord?id=CVE-2026-14257
• https://nvd.nist.gov/vuln/detail/CVE-2026-14257
• https://github.com/juliangruber/brace-expansion
• https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
• https://www.npmjs.com/package/brace-expansion

---

fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority

CVE-2026-18446

More information

Details

A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion. A remote attacker could exploit this to bypass security policies, such as allowlists or Server-Side Request Forgery (SSRF) filters, potentially redirecting applications to unintended hosts.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-18446
• https://bugzilla.redhat.com/show_bug.cgi?id=2509801
• https://www.cve.org/CVERecord?id=CVE-2026-18446
• https://nvd.nist.gov/vuln/detail/CVE-2026-18446
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7

---

cluster-samples-operator: Role reads ALL secrets in openshift-config, not just pull-secret

CVE-2026-107176

More information

Details

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-107176
• https://bugzilla.redhat.com/show_bug.cgi?id=2523035
• https://www.cve.org/CVERecord?id=CVE-2026-107176
• https://nvd.nist.gov/vuln/detail/CVE-2026-107176

---

nanoid: nanoid: Denial of Service via infinite loop in random ID generation

CVE-2026-67213

More information

Details

A flaw was found in nanoid (Nano ID), a small, secure, and URL-friendly unique string ID generator. An attacker could exploit this vulnerability by providing a zero-size input to the customAlphabet or customRandom functions. This would cause an infinite loop, leading to a denial of service (DoS) condition by hanging the application's calling thread.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-67213
• https://bugzilla.redhat.com/show_bug.cgi?id=2508406
• https://www.cve.org/CVERecord?id=CVE-2026-67213
• https://nvd.nist.gov/vuln/detail/CVE-2026-67213
• https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
• https://github.com/ai/nanoid/releases/tag/5.1.6
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom

---

oc-mirror__release-4.21: Embedded local cache registry listens on all interfaces without authentication, with delete enabled

CVE-2026-96577

More information

Details

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-96577
• https://bugzilla.redhat.com/show_bug.cgi?id=2523077
• https://www.cve.org/CVERecord?id=CVE-2026-96577
• https://nvd.nist.gov/vuln/detail/CVE-2026-96577

---

linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability

CVE-2026-48801

More information

Details

A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of O(N²) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-48801
• https://bugzilla.redhat.com/show_bug.cgi?id=2500656
• https://www.cve.org/CVERecord?id=CVE-2026-48801
• https://nvd.nist.gov/vuln/detail/CVE-2026-48801
• https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159
• https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4

---

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing

CVE-2026-54284

More information

Details

A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit a vulnerability in the TokenList construction and string conversion processes, specifically when handling nested token subtrees. This flaw leads to quadratic CPU consumption, which can result in a Denial of Service (DoS) by exhausting system resources before internal limits are reached.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-54284
• https://bugzilla.redhat.com/show_bug.cgi?id=2517527
• https://www.cve.org/CVERecord?id=CVE-2026-54284
• https://nvd.nist.gov/vuln/detail/CVE-2026-54284
• https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f
• https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f

---

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

CVE-2026-56852

More information

Details

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56852
• https://bugzilla.redhat.com/show_bug.cgi?id=2504233
• https://www.cve.org/CVERecord?id=CVE-2026-56852
• https://nvd.nist.gov/vuln/detail/CVE-2026-56852
• https://go.dev/cl/794100
• https://go.dev/issue/80142
• https://pkg.go.dev/vuln/GO-2026-5970

---

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

CVE-2026-69192

More information

Details

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-69192
• https://bugzilla.redhat.com/show_bug.cgi?id=2510801
• https://www.cve.org/CVERecord?id=CVE-2026-69192
• https://nvd.nist.gov/vuln/detail/CVE-2026-69192
• https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e
• https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1
• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr

---

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

CVE-2026-33818

More information

Details

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-33818
• https://bugzilla.redhat.com/show_bug.cgi?id=2515815
• https://www.cve.org/CVERecord?id=CVE-2026-33818
• https://nvd.nist.gov/vuln/detail/CVE-2026-33818
• https://go.dev/cl/814980
• https://go.dev/issue/80405
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-5972

---

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

CVE-2026-56858

More information

Details

A flaw was found in the html/template component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56858
• https://bugzilla.redhat.com/show_bug.cgi?id=2515838
• https://www.cve.org/CVERecord?id=CVE-2026-56858
• https://nvd.nist.gov/vuln/detail/CVE-2026-56858
• https://go.dev/cl/807100
• https://go.dev/issue/80435
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6091

---

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

CVE-2026-56859

More information

Details

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56859
• https://bugzilla.redhat.com/show_bug.cgi?id=2515840
• https://www.cve.org/CVERecord?id=CVE-2026-56859
• https://nvd.nist.gov/vuln/detail/CVE-2026-56859
• https://go.dev/cl/803320
• https://go.dev/issue/80481
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6088

---

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

CVE-2026-56860

More information

Details

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56860
• https://bugzilla.redhat.com/show_bug.cgi?id=2515820
• https://www.cve.org/CVERecord?id=CVE-2026-56860
• https://nvd.nist.gov/vuln/detail/CVE-2026-56860
• https://go.dev/cl/803681
• https://go.dev/issue/80494
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6218

---

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

CVE-2026-56862

More information

Details

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56862
• https://bugzilla.redhat.com/show_bug.cgi?id=2515839
• https://www.cve.org/CVERecord?id=CVE-2026-56862
• https://nvd.nist.gov/vuln/detail/CVE-2026-56862
• https://go.dev/cl/804261
• https://go.dev/issue/80528
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6090

---

protobufjs: protobufjs: Denial of Service via crafted .proto schema

CVE-2026-59877

More information

Details

A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library's parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59877
• https://bugzilla.redhat.com/show_bug.cgi?id=2498127
• https://www.cve.org/CVERecord?id=CVE-2026-59877
• https://nvd.nist.gov/vuln/detail/CVE-2026-59877
• https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217
• https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f
• https://github.com/protobufjs/protobuf.js/pull/2352
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww

---

ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration

CVE-2026-66138

More information

Details

A vulnerability was found in Ironic-Python-Agent's (IPA) time syncing code. The value of the ntp_server configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root. This value can be set in three ways; directly in an operator-created ramdisk, set via kernel command line using Ironic, or passing the parameters via mDNS responder for mDNS enabled installation. For the most common, and highest security risk case, this means a Manager role associated with the project set as node.owner may be able to trigger this vulnerability.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-66138
• https://bugzilla.redhat.com/show_bug.cgi?id=2506676
• https://www.cve.org/CVERecord?id=CVE-2026-66138
• https://nvd.nist.gov/vuln/detail/CVE-2026-66138
• https://bugs.launchpad.net/ironic-python-agent/+bug/2160050
• https://launchpad.net/bugs/2160050
• https://opendev.org/openstack/ossa/commit/b6468150ceb59957bfe541d431e90b9651abed51
• https://review.opendev.org/c/openstack/ironic-python-agent/+/998486
• https://security.openstack.org/ossa/OSSA-2026-027.html

---

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

CVE-2026-69152

More information

Details

A flaw was found in the brace-expansion library. The expand() function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-69152
• https://bugzilla.redhat.com/show_bug.cgi?id=2510722
• https://www.cve.org/CVERecord?id=CVE-2026-69152
• https://nvd.nist.gov/vuln/detail/CVE-2026-69152
• https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
• https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
• https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
• https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895

---

nanoid: nanoid: Predictable ID generation due to integer overflow

CVE-2026-73086

More information

Details

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoid(size) function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-73086
• https://bugzilla.redhat.com/show_bug.cgi?id=2514175
• https://www.cve.org/CVERecord?id=CVE-2026-73086
• https://nvd.nist.gov/vuln/detail/CVE-2026-73086
• https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
• https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
• https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
• https://github.com/ai/nanoid/releases/tag/3.3.12
• https://github.com/ai/nanoid/releases/tag/5.1.11
• https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w

---

baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling

CVE-2026-45819

More information

Details

A flaw was found in baseline-browser-mapping. This vulnerability allows an attacker to cause a denial of service by providing invalid or conflicting input parameters. The affected component improperly terminates the process instead of handling the input error gracefully, leading to immediate service disruption.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-45819
• https://bugzilla.redhat.com/show_bug.cgi?id=2515240
• https://www.cve.org/CVERecord?id=CVE-2026-45819
• https://nvd.nist.gov/vuln/detail/CVE-2026-45819
• https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142
• https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519
• https://www.npmjs.com/package/baseline-browser-mapping

---

linkify-it: linkify-it: Denial of Service via crafted mailto: links

CVE-2026-59887

More information

Details

A flaw was found in linkify-it, a library for recognizing links. A remote attacker could exploit this vulnerability by providing specially crafted user text. The mailto: schema validator, when processing this input, can be repeatedly invoked, leading to excessive CPU consumption. This can result in a Denial of Service (DoS) for the affected system.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59887
• https://bugzilla.redhat.com/show_bug.cgi?id=2498146
• https://www.cve.org/CVERecord?id=CVE-2026-59887
• https://nvd.nist.gov/vuln/detail/CVE-2026-59887
• https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe
• https://github.com/markdown-it/linkify-it/releases/tag/5.0.2
• https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm

---

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

CVE-2026-56853

More information

Details

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56853
• [https

✂ Note

PR body was truncated to here.