RHSA-2026:91249
Vulnerability from csaf_redhat - Published: 2026-10-27 19:14 - Updated: 2026-10-30 20:12Summary
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)
Severity
Critical
Notes
Topic: Red Hat AI Base Images 3.5.5 (Neuron) is now available.
Details: Red Hat® AI Base Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in OpenSSL. When applications directly call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are not covered by the authentication tag, allowing an attacker to read or tamper with them without detection.
4.0 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the `xmlParseInternalSubset` function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially allow the attacker to execute arbitrary code within the context of the xmlcatalog process.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to arbitrary locations on the system, potentially leading to system compromise. This vulnerability primarily affects users utilizing the `pip download` command with the `--only-binary` option.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. A remote attacker could provide specially crafted HTML, which, when parsed by the affected component, would consume excessive CPU resources. This could lead to a Denial of Service (DoS) condition, making the system unavailable to legitimate users.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
CWE-295 - Improper Certificate ValidationAffected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Low
A path traversal flaw has been discovered in the golang `os` module. On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Low
A flaw was found in golang.org/x/net/http2. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames, which are data packets used in the HTTP/2 protocol. Due to a missing check for null values, processing these specific frames (types 0x0a through 0x0f) can cause the server to crash. This leads to a Denial of Service (DoS) condition, making the affected server unavailable to legitimate users.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
An input escaping flaw has been discovered in the golang html/template module. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
5.4 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in Go's `archive/tar` package. A remote attacker could exploit this vulnerability by providing a maliciously-crafted archive file. When the `tar.Reader` processes an archive containing a large number of sparse regions in the "old GNU sparse map" format, it can lead to unbounded memory allocation. This can result in a Denial of Service (DoS) condition, making the affected application unresponsive.
4.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be incorrectly or improperly escaped, leading to Cross-Site Scripting (XSS) vulnerabilities. This could allow an attacker to inject malicious scripts into web pages viewed by other users.
5.4 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in OpenSSL's QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL's content attribute inside a `<meta>` tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user's browser.
5.4 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs because the `ReverseProxy` does not correctly consider the `url.ParseQuery` limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by `Rewrite` functions, leading to information disclosure or unexpected behavior.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user's browser.
5.4 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service (DoS) for applications using these functions.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's web browser, potentially compromising user data or taking control of their session.
6.1 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in the `crypto/tls` package in Go. Handshakes utilizing Encrypted Client Hello (ECH) could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link connections.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in golang.org/x/net/html. When parsing arbitrary HTML that is subsequently rendered, an unexpected HTML tree can be generated. A remote attacker could leverage this vulnerability to execute Cross-Site Scripting (XSS) attacks in applications that attempt to sanitize input HTML before rendering, potentially leading to unauthorized actions or information disclosure.
5.4 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead to confusion or misinterpretation of critical system information.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.
9.1 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
8.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.
6.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).
6.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.
6.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw in libxml2's XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.
5.6 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in the event stream header decoder of the Amazon AWS SDK for Go v2. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted event stream response frame. This frame, containing a header value type outside the valid range, would cause an unrecovered panic, leading to the termination of the consuming application process and resulting in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Moderate
A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).
7.6 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Important
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
6.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2025-69418
Threats
Impact
Critical
References
376 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AI Base Images 3.5.5 (Neuron) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat\u00ae AI Base Images",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:91249",
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-69418",
"url": "https://access.redhat.com/security/cve/CVE-2025-69418"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-103111",
"url": "https://access.redhat.com/security/cve/CVE-2026-103111"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-114406",
"url": "https://access.redhat.com/security/cve/CVE-2026-114406"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11979",
"url": "https://access.redhat.com/security/cve/CVE-2026-11979"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13346",
"url": "https://access.redhat.com/security/cve/CVE-2026-13346"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25680",
"url": "https://access.redhat.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27138",
"url": "https://access.redhat.com/security/cve/CVE-2026-27138"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27139",
"url": "https://access.redhat.com/security/cve/CVE-2026-27139"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27141",
"url": "https://access.redhat.com/security/cve/CVE-2026-27141"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27142",
"url": "https://access.redhat.com/security/cve/CVE-2026-27142"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-28390",
"url": "https://access.redhat.com/security/cve/CVE-2026-28390"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-31790",
"url": "https://access.redhat.com/security/cve/CVE-2026-31790"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32288",
"url": "https://access.redhat.com/security/cve/CVE-2026-32288"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32289",
"url": "https://access.redhat.com/security/cve/CVE-2026-32289"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33814",
"url": "https://access.redhat.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34182",
"url": "https://access.redhat.com/security/cve/CVE-2026-34182"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34183",
"url": "https://access.redhat.com/security/cve/CVE-2026-34183"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39822",
"url": "https://access.redhat.com/security/cve/CVE-2026-39822"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39823",
"url": "https://access.redhat.com/security/cve/CVE-2026-39823"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39825",
"url": "https://access.redhat.com/security/cve/CVE-2026-39825"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39826",
"url": "https://access.redhat.com/security/cve/CVE-2026-39826"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39836",
"url": "https://access.redhat.com/security/cve/CVE-2026-39836"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42502",
"url": "https://access.redhat.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42505",
"url": "https://access.redhat.com/security/cve/CVE-2026-42505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42506",
"url": "https://access.redhat.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42507",
"url": "https://access.redhat.com/security/cve/CVE-2026-42507"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45445",
"url": "https://access.redhat.com/security/cve/CVE-2026-45445"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45447",
"url": "https://access.redhat.com/security/cve/CVE-2026-45447"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6653",
"url": "https://access.redhat.com/security/cve/CVE-2026-6653"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-74860",
"url": "https://access.redhat.com/security/cve/CVE-2026-74860"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86138",
"url": "https://access.redhat.com/security/cve/CVE-2026-86138"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86140",
"url": "https://access.redhat.com/security/cve/CVE-2026-86140"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86142",
"url": "https://access.redhat.com/security/cve/CVE-2026-86142"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86143",
"url": "https://access.redhat.com/security/cve/CVE-2026-86143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86144",
"url": "https://access.redhat.com/security/cve/CVE-2026-86144"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86145",
"url": "https://access.redhat.com/security/cve/CVE-2026-86145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-89090",
"url": "https://access.redhat.com/security/cve/CVE-2026-89090"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-89161",
"url": "https://access.redhat.com/security/cve/CVE-2026-89161"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://www.redhat.com/en/products/ai",
"url": "https://www.redhat.com/en/products/ai"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91249.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)",
"tracking": {
"current_release_date": "2026-10-30T20:12:41+00:00",
"generator": {
"date": "2026-10-30T20:12:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:91249",
"initial_release_date": "2026-10-27T19:14:39+00:00",
"revision_history": [
{
"date": "2026-10-27T19:14:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-27T19:14:45+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-30T20:12:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift AI 3.5",
"product": {
"name": "Red Hat OpenShift AI 3.5",
"product_id": "Red Hat OpenShift AI 3.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_ai:3.5::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift AI"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64",
"product": {
"name": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64",
"product_id": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/base-image-neuron-rhel9@sha256%3Aa58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd?arch=amd64\u0026repository_url=registry.redhat.io/rhai/base-image-neuron-rhel9\u0026tag=1793042008"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64 as a component of Red Hat OpenShift AI 3.5",
"product_id": "Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
},
"product_reference": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64",
"relates_to_product_reference": "Red Hat OpenShift AI 3.5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-69418",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-01-16T14:21:52.438000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2430381"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. When applications directly call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are not covered by the authentication tag, allowing an attacker to read or tamper with them without detection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Low for Red Hat products. In the Red Hat context, impact is limited because typical OpenSSL consumers using higher-level EVP APIs are not affected. The flaw only manifests when applications directly call low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths in hardware-accelerated builds. Additionally, TLS does not use OCB ciphersuites, and FIPS modules are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-69418"
},
{
"category": "external",
"summary": "RHBZ#2430381",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-69418",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69418"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69418",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69418"
}
],
"release_date": "2026-01-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls"
},
{
"cve": "CVE-2026-6653",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-06-22T14:01:42.248415+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491354"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the `xmlParseInternalSubset` function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact use-after-free vulnerability in libxml2 can lead to a denial of service in Red Hat products that process untrusted XML input. In the worst-case scenario, a remote attacker is able to provide specially crafted XML, which, if parsed by an affected application, could cause the application to crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6653"
},
{
"category": "external",
"summary": "RHBZ#2491354",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491354"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6653",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6653"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653"
},
{
"category": "external",
"summary": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260",
"url": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"
}
],
"release_date": "2026-06-22T12:40:31.424000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\nUpdating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free"
},
{
"cve": "CVE-2026-11979",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-06-29T14:01:11.961973+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494191"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially allow the attacker to execute arbitrary code within the context of the xmlcatalog process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in libxml2 affects the `xmlcatalog` utility when operating in `--shell` mode. Exploitation requires an attacker to provide specially crafted, excessively long input, leading to stack-based buffer overflows. This vulnerability is limited to scenarios where an attacker can control input to the `xmlcatalog` utility, reducing its overall exposure in typical Red Hat deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11979"
},
{
"category": "external",
"summary": "RHBZ#2494191",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494191"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11979"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11979",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11979"
},
{
"category": "external",
"summary": "https://cert.pl/en/posts/2026/06/CVE-2026-11979",
"url": "https://cert.pl/en/posts/2026/06/CVE-2026-11979"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e"
}
],
"release_date": "2026-06-29T13:21:42.697000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow"
},
{
"cve": "CVE-2026-13346",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-07-29T19:00:56.926395+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2508514"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to arbitrary locations on the system, potentially leading to system compromise. This vulnerability primarily affects users utilizing the `pip download` command with the `--only-binary` option.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pip: pip: Arbitrary file installation via malicious package indexes",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13346"
},
{
"category": "external",
"summary": "RHBZ#2508514",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508514"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13346"
},
{
"category": "external",
"summary": "https://github.com/pypa/pip/pull/14110",
"url": "https://github.com/pypa/pip/pull/14110"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/"
}
],
"release_date": "2026-07-29T18:33:50.820000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "pip: pip: Arbitrary file installation via malicious package indexes"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat evaluates this vulnerability as having an Important severity because unauthenticated remote attackers can target exposed Go services over the network to trigger severe denial-of-service conditions or validation discrepancies without requiring elevated privileges. Across standard Red Hat environments\u2014including OpenShift Container Platform and Red Hat Enterprise Linux container tools\u2014many components rely on the core Go runtime to process user-supplied addresses and endpoints. Although improper handling of malformed host segments in web addresses can disrupt network-facing daemons, the vulnerability cannot be leveraged for arbitrary code execution or data leakage, keeping the risk bounded within the Important classification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-25680",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-05-22T16:01:05.431197+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480760"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could provide specially crafted HTML, which, when parsed by the affected component, would consume excessive CPU resources. This could lead to a Denial of Service (DoS) condition, making the system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Moderate with RH CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). A flaw was found in golang.org/x/net/html where parsing crafted HTML can consume excessive CPU time, leading to denial of service. Exploitation requires user interaction (a victim application parsing attacker-controlled HTML). Most Red Hat products that bundle golang.org/x/net do not use the html parser to process untrusted HTML in their supported execution paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "RHBZ#2480760",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480760"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25680"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25680",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25680"
},
{
"category": "external",
"summary": "https://go.dev/cl/781702",
"url": "https://go.dev/cl/781702"
},
{
"category": "external",
"summary": "https://go.dev/issue/79573",
"url": "https://go.dev/issue/79573"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5028",
"url": "https://pkg.go.dev/vuln/GO-2026-5028"
}
],
"release_date": "2026-05-22T15:01:21.805000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse untrusted HTML content, or enforce timeouts on HTML parsing operations. Applications that do not parse arbitrary HTML are not affected.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing"
},
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because unauthenticated network entities can bypass identity restrictions without requiring local system privileges. In Red Hat environments hosting Go-based network services or container infrastructure, certificate chain validation overlooks specific email name constraints when multiple rules share an identical local mailbox name across distinct domain names. As a result, a subordinate certificate authority could successfully issue unauthorized certificates that circumvent organizational security policies, leading to improper trust establishment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-27138",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:35.939008+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445344"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Panic in name constraint checking for malformed certificates in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27138"
},
{
"category": "external",
"summary": "RHBZ#2445344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27138"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27138",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27138"
},
{
"category": "external",
"summary": "https://go.dev/cl/752183",
"url": "https://go.dev/cl/752183"
},
{
"category": "external",
"summary": "https://go.dev/issue/77953",
"url": "https://go.dev/issue/77953"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4600",
"url": "https://pkg.go.dev/vuln/GO-2026-4600"
}
],
"release_date": "2026-03-06T21:28:14+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "crypto/x509: Panic in name constraint checking for malformed certificates in crypto/x509"
},
{
"cve": "CVE-2026-27139",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-06T22:01:08.670782+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445335"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal flaw has been discovered in the golang `os` module. On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "os: FileInfo can escape from a Root in golang os module",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27139"
},
{
"category": "external",
"summary": "RHBZ#2445335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27139"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27139",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27139"
},
{
"category": "external",
"summary": "https://go.dev/cl/749480",
"url": "https://go.dev/cl/749480"
},
{
"category": "external",
"summary": "https://go.dev/issue/77827",
"url": "https://go.dev/issue/77827"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4602",
"url": "https://pkg.go.dev/vuln/GO-2026-4602"
}
],
"release_date": "2026-03-06T21:28:14.451000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "os: FileInfo can escape from a Root in golang os module"
},
{
"cve": "CVE-2026-27141",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-02-26T20:09:11.626155+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2443104"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/http2. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames, which are data packets used in the HTTP/2 protocol. Due to a missing check for null values, processing these specific frames (types 0x0a through 0x0f) can cause the server to crash. This leads to a Denial of Service (DoS) condition, making the affected server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27141"
},
{
"category": "external",
"summary": "RHBZ#2443104",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443104"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27141"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27141",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27141"
},
{
"category": "external",
"summary": "https://go.dev/cl/746180",
"url": "https://go.dev/cl/746180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77652",
"url": "https://go.dev/issue/77652"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4559",
"url": "https://pkg.go.dev/vuln/GO-2026-4559"
}
],
"release_date": "2026-02-26T18:50:31.830000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames"
},
{
"cve": "CVE-2026-27142",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-03-06T22:01:56.662646+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445351"
}
],
"notes": [
{
"category": "description",
"text": "An input escaping flaw has been discovered in the golang html/template module. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "html/template: URLs in meta content attribute actions are not escaped in html/template",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27142"
},
{
"category": "external",
"summary": "RHBZ#2445351",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445351"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27142"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27142",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27142"
},
{
"category": "external",
"summary": "https://go.dev/cl/752081",
"url": "https://go.dev/cl/752081"
},
{
"category": "external",
"summary": "https://go.dev/issue/77954",
"url": "https://go.dev/issue/77954"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4603",
"url": "https://pkg.go.dev/vuln/GO-2026-4603"
}
],
"release_date": "2026-03-06T21:28:14.674000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "html/template: URLs in meta content attribute actions are not escaped in html/template"
},
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-28390",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-04-07T23:01:18.313921+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456314"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been rated as moderate by redhat because the vulnerability is limited to a denial-of-service condition caused by a NULL pointer dereference in OpenSSL CMS processing, without evidence of memory corruption or code execution, furthermore the Affected functionality is niche. The vulnerable path requires:\nCMS/S/MIME processing,\nspecifically CMS_decrypt(),\nwith RSA-OAEP KeyTransportRecipientInfo.\nMany OpenSSL consumers never use CMS APIs, never process S/MIME,\nor do not decrypt attacker-controlled CMS objects.\nSo exposure is far narrower than a generic TLS parsing vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-28390"
},
{
"category": "external",
"summary": "RHBZ#2456314",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456314"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-28390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28390"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc",
"url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6",
"url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4",
"url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788",
"url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75",
"url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260407.txt",
"url": "https://openssl-library.org/news/secadv/20260407.txt"
}
],
"release_date": "2026-04-07T22:00:54.172000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Applications that process Cryptographic Message Syntax (CMS) EnvelopedData messages should be configured to only accept input from trusted sources. Restricting network access to services that process untrusted CMS data can also reduce exposure to this Denial of Service vulnerability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing"
},
{
"cve": "CVE-2026-31790",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-03-25T02:59:10.179000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451094"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. This flaw affects applications utilizing RSASVE key encapsulation, where an attacker-supplied invalid RSA public key is used with EVP_PKEY_encapsulate() without prior validation. This can lead to the disclosure of sensitive, uninitialized memory buffer contents to a malicious peer.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-31790"
},
{
"category": "external",
"summary": "RHBZ#2451094",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451094"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-31790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260407.txt",
"url": "https://openssl-library.org/news/secadv/20260407.txt"
}
],
"release_date": "2026-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32288",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:00:57.624222+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `archive/tar` package. A remote attacker could exploit this vulnerability by providing a maliciously-crafted archive file. When the `tar.Reader` processes an archive containing a large number of sparse regions in the \"old GNU sparse map\" format, it can lead to unbounded memory allocation. This can result in a Denial of Service (DoS) condition, making the affected application unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "archive/tar: golang: Go\u0027s archive/tar package: Denial of Service via maliciously-crafted archive",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32288"
},
{
"category": "external",
"summary": "RHBZ#2456332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32288"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32288",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32288"
},
{
"category": "external",
"summary": "https://go.dev/cl/763766",
"url": "https://go.dev/cl/763766"
},
{
"category": "external",
"summary": "https://go.dev/issue/78301",
"url": "https://go.dev/issue/78301"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4869",
"url": "https://pkg.go.dev/vuln/GO-2026-4869"
}
],
"release_date": "2026-04-08T01:06:57.416000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "archive/tar: golang: Go\u0027s archive/tar package: Denial of Service via maliciously-crafted archive"
},
{
"cve": "CVE-2026-32289",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-04-08T02:01:05.911683+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be incorrectly or improperly escaped, leading to Cross-Site Scripting (XSS) vulnerabilities. This could allow an attacker to inject malicious scripts into web pages viewed by other users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32289"
},
{
"category": "external",
"summary": "RHBZ#2456334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32289"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32289",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32289"
},
{
"category": "external",
"summary": "https://go.dev/cl/763762",
"url": "https://go.dev/cl/763762"
},
{
"category": "external",
"summary": "https://go.dev/issue/78331",
"url": "https://go.dev/issue/78331"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4865",
"url": "https://pkg.go.dev/vuln/GO-2026-4865"
}
],
"release_date": "2026-04-08T01:06:56.297000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-33814",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:11.324941+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in the Go HTTP/2 protocol implementation allows a remote, unauthenticated attacker to exhaust system resources. By sending a specially crafted HTTP/2 SETTINGS frame with a zero-value SETTINGS_MAX_FRAME_SIZE, the vulnerable Go library enters an infinite loop, impacting the availability of services utilizing HTTP/2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "RHBZ#2467815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33814"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814"
},
{
"category": "external",
"summary": "https://go.dev/cl/761581",
"url": "https://go.dev/cl/761581"
},
{
"category": "external",
"summary": "https://go.dev/cl/761640",
"url": "https://go.dev/cl/761640"
},
{
"category": "external",
"summary": "https://go.dev/issue/78476",
"url": "https://go.dev/issue/78476"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4918",
"url": "https://pkg.go.dev/vuln/GO-2026-4918"
}
],
"release_date": "2026-05-07T19:41:17.631000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
},
{
"cve": "CVE-2026-34182",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-05-27T13:59:43+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481884"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL\u0027s Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: This flaw in OpenSSL\u0027s Cryptographic Message Services (CMS) AuthEnvelopedData processing could allow an on-path attacker to forge messages or bypass integrity validation. This is due to insufficient input validation on cipher and tag length fields, potentially leading to key-equivalent functionality or integrity bypass in applications utilizing affected OpenSSL versions for CMS AuthEnvelopedData.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34182"
},
{
"category": "external",
"summary": "RHBZ#2481884",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34182"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182"
}
],
"release_date": "2026-06-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Systems configured to operate in FIPS mode are not affected by this vulnerability. To mitigate this issue, ensure that OpenSSL is operating in FIPS mode by enabling the system-wide FIPS policy. This may have broader implications for cryptographic operations on the system and should be evaluated for compatibility with existing applications. A system reboot may be required for the changes to take effect.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages"
},
{
"cve": "CVE-2026-34183",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-27T14:04:59+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481885"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL\u0027s QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate severity flaw exists in the QUIC PATH_CHALLENGE handler, allowing a remote attacker to exhaust heap memory of a QUIC client or server. By flooding the local QUIC stack with PATH_CHALLENGE frames, a malicious peer can trigger unbounded memory allocation, leading to a denial of service for applications utilizing the vulnerable QUIC implementation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34183"
},
{
"category": "external",
"summary": "RHBZ#2481885",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34183"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34183",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34183"
}
],
"release_date": "2026-06-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, apply UDP rate limiting at your network edge to throttle malicious traffic. If QUIC is not strictly required, disable the listener entirely and configure your application to use standard TLS over TCP. Additionally, enforce strict process memory limits using cgroups to prevent host-wide memory exhaustion during an attack.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39822",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-07-08T17:01:53.592869+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498152"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: Go os.Root: Symlink following vulnerability allows directory traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Go\u0027s os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open(\"symlink/\")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.\n\nThe following symbols are affected:\n* `OpenInRoot`: Opens a file or directory within an `os.Root`.\n* `Root.Create`: Creates a file inside an `os.Root`.\n* `Root.Open`: Opens a path relative to an `os.Root`.\n* `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`.\n* `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`.\n* `Root.ReadFile`: Reads a file inside an `os.Root`.\n* `Root.WriteFile`: Writes a file inside an `os.Root`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39822"
},
{
"category": "external",
"summary": "RHBZ#2498152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
},
{
"category": "external",
"summary": "https://go.dev/cl/797880",
"url": "https://go.dev/cl/797880"
},
{
"category": "external",
"summary": "https://go.dev/issue/79005",
"url": "https://go.dev/issue/79005"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
"url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4970",
"url": "https://pkg.go.dev/vuln/GO-2026-4970"
}
],
"release_date": "2026-07-08T15:46:27.199000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go \u003e= 1.24 that do not use the os.Root API are not affected by this vulnerability.\nThe os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected.\nThis issue is fixed in Go 1.25.12 and Go 1.26.5.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
},
{
"cve": "CVE-2026-39823",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-07T20:00:58.284024+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467811"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL\u0027s content attribute inside a `\u003cmeta\u003e` tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship the Go `html/template` package as a dependency of various Go-based components. The affected functionality involves URL escaping inside `\u003cmeta\u003e` tag content attributes, which requires an application to render user-controlled URLs in meta tags using `html/template`. While the vulnerable code is present, exploitation requires a specific usage pattern that is uncommon in Red Hat product code paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39823"
},
{
"category": "external",
"summary": "RHBZ#2467811",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467811"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39823"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823"
},
{
"category": "external",
"summary": "https://go.dev/cl/769920",
"url": "https://go.dev/cl/769920"
},
{
"category": "external",
"summary": "https://go.dev/issue/78913",
"url": "https://go.dev/issue/78913"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4982",
"url": "https://pkg.go.dev/vuln/GO-2026-4982"
}
],
"release_date": "2026-05-07T19:41:19.524000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Ensure that user-supplied URLs are validated and sanitized before being passed to Go\u0027s `html/template` package for rendering in HTML meta tag content attributes. Avoid rendering untrusted URL data directly in meta tag content attributes.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content"
},
{
"cve": "CVE-2026-39825",
"cwe": {
"id": "CWE-472",
"name": "External Control of Assumed-Immutable Web Parameter"
},
"discovery_date": "2026-05-07T20:01:37.714133+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467823"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs because the `ReverseProxy` does not correctly consider the `url.ParseQuery` limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by `Rewrite` functions, leading to information disclosure or unexpected behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Go\u0027s net/http/httputil package where ReverseProxy can forward query parameters that are hidden from Rewrite or Director functions. This occurs when the number of query parameters exceeds the url.ParseQuery limit (controlled by the GODEBUG setting urlmaxqueryparams). While Red Hat ships Go-based components across many products, exploitation requires that an application use ReverseProxy with a Rewrite or Director function that relies on query parameter inspection for security enforcement, which limits the practical impact of this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39825"
},
{
"category": "external",
"summary": "RHBZ#2467823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467823"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39825"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825"
},
{
"category": "external",
"summary": "https://go.dev/cl/770541",
"url": "https://go.dev/cl/770541"
},
{
"category": "external",
"summary": "https://go.dev/issue/78948",
"url": "https://go.dev/issue/78948"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4976",
"url": "https://pkg.go.dev/vuln/GO-2026-4976"
}
],
"release_date": "2026-05-07T19:41:18.453000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy\u0027s Rewrite or Director function for security filtering.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls"
},
{
"cve": "CVE-2026-39826",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-07T20:01:46.305827+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467826"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only \u0027type\u0027 attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate cross-site scripting (XSS) vulnerability in Go\u0027s html/template package occurs when a script tag with an empty or whitespace-only \u0027type\u0027 attribute is used in a template, causing the template engine to incorrectly escape data passed into the script block. This requires a trusted template author to introduce the vulnerable template pattern before an attacker can inject malicious scripts.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39826"
},
{
"category": "external",
"summary": "RHBZ#2467826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467826"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39826",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39826"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826"
},
{
"category": "external",
"summary": "https://go.dev/cl/771180",
"url": "https://go.dev/cl/771180"
},
{
"category": "external",
"summary": "https://go.dev/issue/78981",
"url": "https://go.dev/issue/78981"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4980",
"url": "https://pkg.go.dev/vuln/GO-2026-4980"
}
],
"release_date": "2026-05-07T19:41:19.138000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping"
},
{
"cve": "CVE-2026-39836",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-05-07T20:01:49.423498+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467827"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service (DoS) for applications using these functions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This denial of service flaw exists within the Go `net` package, specifically impacting applications when executed on Microsoft Windows operating systems. Red Hat Product Security has rated this flaw as a Moderate as Red Hat products primarily deploy Go applications on Linux-based environments. Customers operating Go applications, including those bundled with Red Hat products, within a Windows environment should assess their exposure to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39836"
},
{
"category": "external",
"summary": "RHBZ#2467827",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467827"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39836"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39836",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39836"
},
{
"category": "external",
"summary": "https://go.dev/cl/775320",
"url": "https://go.dev/cl/775320"
},
{
"category": "external",
"summary": "https://go.dev/issue/79006",
"url": "https://go.dev/issue/79006"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4971",
"url": "https://pkg.go.dev/vuln/GO-2026-4971"
}
],
"release_date": "2026-05-07T19:41:18.300000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42502",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:11.151484+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480762"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user\u0027s web browser, potentially compromising user data or taking control of their session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in golang.org/x/net/html can lead to Cross-Site Scripting (XSS) in applications that parse and render untrusted HTML, even with sanitization attempts. This is due to an unexpected HTML tree structure, allowing malicious scripts to execute in a user\u0027s browser.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "RHBZ#2480762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
},
{
"category": "external",
"summary": "https://go.dev/cl/781701",
"url": "https://go.dev/cl/781701"
},
{
"category": "external",
"summary": "https://go.dev/issue/79572",
"url": "https://go.dev/issue/79572"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5027",
"url": "https://pkg.go.dev/vuln/GO-2026-5027"
}
],
"release_date": "2026-05-22T15:01:21.649000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering"
},
{
"cve": "CVE-2026-42504",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-02T23:01:00.320527+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484204"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "RHBZ#2484204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://go.dev/cl/774481",
"url": "https://go.dev/cl/774481"
},
{
"category": "external",
"summary": "https://go.dev/issue/79217",
"url": "https://go.dev/issue/79217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5038",
"url": "https://pkg.go.dev/vuln/GO-2026-5038"
}
],
"release_date": "2026-06-02T22:01:37.219000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
},
{
"cve": "CVE-2026-42505",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-08T17:01:05.490547+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498138"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package in Go. Handshakes utilizing Encrypted Client Hello (ECH) could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link connections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate-impact information disclosure flaw in the Go `crypto/tls` package allows a passive network observer to de-anonymize connections utilizing Encrypted Client Hello (ECH). The vulnerability stems from the unintentional exposure of pre-shared key identities within the unencrypted client hello, potentially enabling an attacker to link previously anonymous connections. This primarily affects the privacy of communications rather than integrity or availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42505"
},
{
"category": "external",
"summary": "RHBZ#2498138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498138"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42505"
},
{
"category": "external",
"summary": "https://go.dev/cl/775960",
"url": "https://go.dev/cl/775960"
},
{
"category": "external",
"summary": "https://go.dev/issue/79282",
"url": "https://go.dev/issue/79282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
"url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5856",
"url": "https://pkg.go.dev/vuln/GO-2026-5856"
}
],
"release_date": "2026-07-08T15:46:33.407000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello"
},
{
"cve": "CVE-2026-42506",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:02.675281+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When parsing arbitrary HTML that is subsequently rendered, an unexpected HTML tree can be generated. A remote attacker could leverage this vulnerability to execute Cross-Site Scripting (XSS) attacks in applications that attempt to sanitize input HTML before rendering, potentially leading to unauthorized actions or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in `golang.org/x/net/html` can lead to Cross-Site Scripting (XSS) in applications that process and render untrusted HTML, even when input sanitization is implemented. The vulnerability arises from an unexpected HTML tree structure generated during parsing, potentially allowing a remote attacker to execute arbitrary script code in the user\u0027s browser, leading to information disclosure or unauthorized actions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "RHBZ#2480759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42506",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42506"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42506",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42506"
},
{
"category": "external",
"summary": "https://go.dev/cl/781700",
"url": "https://go.dev/cl/781700"
},
{
"category": "external",
"summary": "https://go.dev/issue/79571",
"url": "https://go.dev/issue/79571"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5025",
"url": "https://pkg.go.dev/vuln/GO-2026-5025"
}
],
"release_date": "2026-05-22T15:01:21.056000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse and re-render untrusted HTML content. Applications that do not parse arbitrary HTML are not affected.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing"
},
{
"cve": "CVE-2026-42507",
"cwe": {
"id": "CWE-117",
"name": "Improper Output Neutralization for Logs"
},
"discovery_date": "2026-06-02T23:01:03.125126+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484205"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead to confusion or misinterpretation of critical system information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/textproto: golang: Golang net/textproto: Misleading error messages via input injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42507"
},
{
"category": "external",
"summary": "RHBZ#2484205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484205"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42507"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42507",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42507"
},
{
"category": "external",
"summary": "https://go.dev/cl/777060",
"url": "https://go.dev/cl/777060"
},
{
"category": "external",
"summary": "https://go.dev/issue/79346",
"url": "https://go.dev/issue/79346"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5039",
"url": "https://pkg.go.dev/vuln/GO-2026-5039"
}
],
"release_date": "2026-06-02T22:01:37.307000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "net/textproto: golang: Golang net/textproto: Misleading error messages via input injection"
},
{
"cve": "CVE-2026-45445",
"cwe": {
"id": "CWE-1204",
"name": "Generation of Weak Initialization Vector (IV)"
},
"discovery_date": "2026-05-27T14:17:46+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481896"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a Moderate severity flaw where applications utilizing the AES-OCB cipher through OpenSSL\u0027s EVP_Cipher() one-shot interface may silently discard the provided initialization vector (IV). This leads to nonce reuse, compromising confidentiality and enabling universal forgery of authentication tags. Red Hat products are primarily affected if they include or rely on third-party applications that specifically employ this less common and discouraged API usage with AES-OCB, as standard OpenSSL SSL/TLS implementations and applications using the recommended streaming AEAD API are not impacted.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45445"
},
{
"category": "external",
"summary": "RHBZ#2481896",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45445"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45445",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45445"
}
],
"release_date": "2026-06-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path"
},
{
"cve": "CVE-2026-45447",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-05-27T14:17:46+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481898"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This High severity heap use-after-free flaw in OpenSSL\u0027s PKCS7_verify() function can be triggered by processing a specially crafted PKCS#7 or S/MIME signed message. This could lead to application crashes, memory corruption, or potentially remote code execution, impacting services that handle such messages. The vulnerability specifically affects applications utilizing OpenSSL PKCS#7 APIs, while those using CMS APIs are not impacted.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45447"
},
{
"category": "external",
"summary": "RHBZ#2481898",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45447"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447"
}
],
"release_date": "2026-06-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()"
},
{
"cve": "CVE-2026-74860",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"discovery_date": "2026-09-08T07:16:42.486000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529697"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: double-free/UAF in libxml2 Python bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat evaluates this vulnerability as having an Important severity because memory corruption resulting from the use-after-free condition could allow remote execution of arbitrary code within the parsing application\u0027s process context. Under typical Red Hat Enterprise Linux deployments, the risk is scoped strictly to Python services that invoke libxml2 push parser interfaces and register custom attribute declaration callbacks on untrusted inputs. Standard C-based libxml2 consumers and applications using tree-based parsing without these specific Python SAX bindings are not exposed to this defect.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-74860"
},
{
"category": "external",
"summary": "RHBZ#2529697",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-74860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860"
}
],
"release_date": "2026-03-08T09:20:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: double-free/UAF in libxml2 Python bindings"
},
{
"cve": "CVE-2026-86138",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-09-05T04:31:00.379678+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528986"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity heap-based buffer overflow in libxml2, specifically within the `xmlDictAddQString` function, could enable arbitrary code execution. While no user interaction or privileges are required, the high attack complexity and local attack vector reduce the overall risk in Red Hat environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86138"
},
{
"category": "external",
"summary": "RHBZ#2528986",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86138"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4",
"url": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:21:53.127000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow"
},
{
"cve": "CVE-2026-86140",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-09-05T04:41:05.796692+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528989"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in libxml2 allows a local attacker to achieve arbitrary code execution due to a stack-based buffer overflow. While requiring local access, the vulnerability\u0027s presence in a fundamental system library could lead to significant system compromise if exploited.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86140"
},
{
"category": "external",
"summary": "RHBZ#2528989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86140"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340",
"url": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:26:13.860000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements"
},
{
"cve": "CVE-2026-86142",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-09-05T04:41:08.714165+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528990"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libxml2\u0027s xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A heap-based buffer overflow in libxml2\u0027s xmlXPtrEvalXPtrPart function enables an out-of-bounds write during the evaluation of oversized xpointer() expressions. The flaw is assigned a Moderate severity rating because exploitation strictly requires local access and complex, multi-gigabyte payload inputs, effectively mitigating the threat of remote or automated system compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86142"
},
{
"category": "external",
"summary": "RHBZ#2528990",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86142"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58",
"url": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"
}
],
"release_date": "2026-09-05T04:29:33.323000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation"
},
{
"cve": "CVE-2026-86143",
"cwe": {
"id": "CWE-192",
"name": "Integer Coercion Error"
},
"discovery_date": "2026-09-05T04:40:59.552825+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528987"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact: This flaw in libxml2, a widely used XML parsing library, is due to an integer overflow in write callbacks. This can lead to negative lengths being passed to write operations, potentially causing data integrity issues in applications that process untrusted XML input and utilize affected write callbacks. The impact is limited to applications that specifically trigger this overflow condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86143"
},
{
"category": "external",
"summary": "RHBZ#2528987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35",
"url": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"
}
],
"release_date": "2026-09-05T04:31:21.187000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Cap process and cgroup memory so a process cannot build a \u22652 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks"
},
{
"cve": "CVE-2026-86144",
"cwe": {
"id": "CWE-669",
"name": "Incorrect Resource Transfer Between Spheres"
},
"discovery_date": "2026-09-05T04:50:58.626617+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528992"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libxml2\u0027s XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate-severity flaw in libxml2 XInclude processing allows custom resource loaders to bypass network restriction flags, enabling unintended external network connections that could cause SSRF, information disclosure, or Denial of Service (DoS). Exploitation requires local access alongside high attack complexity, limiting its immediate widespread impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86144"
},
{
"category": "external",
"summary": "RHBZ#2528992",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86144"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61",
"url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:34:43.972000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation."
},
{
"cve": "CVE-2026-86145",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-05T05:20:54.676360+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528993"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: An out-of-bounds write vulnerability in the PCRE2 library, specifically within the `pcre2_dfa_match` function, could allow arbitrary code execution. This flaw is exploitable in Red Hat products when processing attacker-controlled regular expressions or when a recursive pattern is used in conjunction with a small, API-set heap limit, making it dependent on specific application usage patterns.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86145"
},
{
"category": "external",
"summary": "RHBZ#2528993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528993"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf"
}
],
"release_date": "2026-09-05T05:09:25.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches\u2014such as the reuse of cached memory workspaces\u2014enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions"
},
{
"cve": "CVE-2026-89090",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-09-11T17:21:48.629852+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531982"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the event stream header decoder of the Amazon AWS SDK for Go v2. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted event stream response frame. This frame, containing a header value type outside the valid range, would cause an unrecovered panic, leading to the termination of the consuming application process and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/aws/aws-sdk-go-v2: Amazon AWS SDK for Go v2: Denial of Service via crafted event stream header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in AWS SDK for Go v2 can cause an application to terminate when it processes an attacker-controlled EventStream response with a crafted header.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89090"
},
{
"category": "external",
"summary": "RHBZ#2531982",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531982"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89090",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89090"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89090",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89090"
},
{
"category": "external",
"summary": "https://aws.amazon.com/security/security-bulletins/2026-110-aws/",
"url": "https://aws.amazon.com/security/security-bulletins/2026-110-aws/"
},
{
"category": "external",
"summary": "https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23",
"url": "https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"
},
{
"category": "external",
"summary": "https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2",
"url": "https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2"
}
],
"release_date": "2026-09-11T17:03:33.351000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/aws/aws-sdk-go-v2: Amazon AWS SDK for Go v2: Denial of Service via crafted event stream header"
},
{
"cve": "CVE-2026-89161",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-09-11T04:21:06.963234+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531747"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important memory corruption vulnerability in PCRE2\u0027s JIT compiler. An attacker could exploit a flaw in `pcre2_jit_match` when a previously copied subject is passed as context, potentially leading to arbitrary code execution or denial of service. The high attack complexity and local attack vector reduce the overall risk, but the widespread use of PCRE2 and the potential for severe impact warrant the Important classification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89161"
},
{
"category": "external",
"summary": "RHBZ#2531747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89161"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/pull/937",
"url": "https://github.com/PCRE2Project/pcre2/pull/937"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
}
],
"release_date": "2026-09-11T04:11:51.666000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match"
},
{
"cve": "CVE-2026-103111",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-30T04:40:56.869940+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543797"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-103111"
},
{
"category": "external",
"summary": "RHBZ#2543797",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-103111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m"
}
],
"release_date": "2026-09-30T04:13:59.115000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression"
},
{
"cve": "CVE-2026-114406",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-20T09:01:55.916000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556046"
}
],
"notes": [
{
"category": "description",
"text": "The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114406"
},
{
"category": "external",
"summary": "RHBZ#2556046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
},
{
"category": "external",
"summary": "RHSB-2026-012",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114406"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406"
}
],
"release_date": "2026-10-20T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T19:14:39+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91249",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91249"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:a58c08d0d7d868ef2be9ad7d8e20468d3192a49757f5c34e4e317dd0cdf732cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.