VDB
RHSA-2026:51112
RHSA-2026:51112
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | grafana-selinux-0:10.2.6-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-debugsource-0:10.2.6-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-selinux-0:10.2.6-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-debugsource-0:10.2.6-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-0:10.2.6-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-debuginfo-0:10.2.6-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-0:10.2.6-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-0:10.2.6-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-selinux-0:10.2.6-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-0:10.2.6-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-debugsource-0:10.2.6-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-debuginfo-0:10.2.6-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-selinux-0:10.2.6-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-debuginfo-0:10.2.6-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-debuginfo-0:10.2.6-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-0:10.2.6-22.el9_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
| Red Hat | grafana-debugsource-0:10.2.6-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 10.2.6-22.el9, 10.2.6-22.el9, 10.2.6-22.el9 |
Timeline
- Aug 6, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:51112 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51112.json advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
…and 27 more