workload availability far Schwachstellen (CVE)

9.6Kritisch

CVE-2026-39821 vor 5 Monaten

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/idna; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

1.8%EPSS

7.5Hoch

CVE-2026-39820 vor 6 Monaten

Quadratic string concatentation in consumeComment in net/mail

Go standard library net/mail; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

7.5Hoch

CVE-2026-33811 vor 6 Monaten

Crash when handling long CNAME response in net

Go standard library net; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

7.5Hoch

CVE-2026-42499 vor 6 Monaten

Quadratic string concatenation in consumePhrase in net/mail

Go standard library net/mail; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

7.5Hoch

CVE-2026-33814 vor 6 Monaten

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

golang.org/x/net golang.org/x/net/http2; Go standard library net/http; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

7.3Hoch

CVE-2026-39883 vor 7 Monaten

OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

open-telemetry opentelemetry-go; Red Hat Cert Manager support for Red Hat OpenShift release 1.19; Red Hat multicluster engine for Kubernetes 2.8; Red Hat Red Hat Openshift Data Foundation 4.22

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …