VDB
RHSA-2026:50843
RHSA-2026:50843
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le as a component of Logging for Red Hat OpenShift 6 | * |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x as a component of Logging for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 as a component of Logging for Red Hat OpenShift 6 | * |
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6 | * |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 as a component of Logging for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x as a component of Logging Subsystem for Red Hat OpenShift 6 | * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le as a component of Logging for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x as a component of Logging for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 as a component of Logging for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 as a component of Logging for Red Hat OpenShift 6 | * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le as a component of Logging for Red Hat OpenShift 6.0 | * |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 as a component of Logging for Red Hat OpenShift 6 | * |
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 as a component of Logging for Red Hat OpenShift 6 | * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le as a component of Logging for Red Hat OpenShift 6 | * |
…and 116 more
Timeline
- Aug 5, 2026 CVE Published
- Sep 9, 2026 CVE Updated
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50843 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/cve/CVE-2026-42504 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50843.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
…and 56 more