VDB
RHSA-2026:53412
RHSA-2026:53412
PUBLISHED
CVSS 8.600000381469727 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | opentelemetry-collector-0:0.152.1-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0.152.1-1.el9, 0.152.1-1.el9, 0.152.1-1.el9 |
| Red Hat | opentelemetry-collector-0:0.152.1-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0.152.1-1.el9, 0.152.1-1.el9, 0.152.1-1.el9 |
| Red Hat | opentelemetry-collector-0:0.152.1-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0.152.1-1.el9, 0.152.1-1.el9, 0.152.1-1.el9 |
| Red Hat | opentelemetry-collector-0:0.152.1-1.el9_4.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0.152.1-1.el9, 0.152.1-1.el9, 0.152.1-1.el9 |
| Red Hat | opentelemetry-collector-0:0.152.1-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0.152.1-1.el9, 0.152.1-1.el9, 0.152.1-1.el9 |
Timeline
- Aug 11, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:53412 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2466505 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2466507 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2466671 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484207 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53412.json advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
…and 42 more