VDB
RHSA-2026:54283
RHSA-2026:54283
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | OpenShift Workload Availability | |
| golang | x/net | |
| Red Hat | Red Hat OpenShift Workload Availability | |
| Red Hat | registry.redhat.io/workload-availability/node-maintenance-rhel9-operator@sha256:67e3d07fe82432bc0c016163c00b18d1f297f4b98c5fc7c80065404d240c5bfc_ppc64le as a component of Red Hat OpenShift Workload Availability 5.7 | *, *, * |
| Red Hat | registry.redhat.io/workload-availability/node-maintenance-rhel9-operator@sha256:4f8991fd01de2e5a7e1fd67b4ae76c5ec8e2d39d49a315b770b1515cc959e83d_s390x as a component of Red Hat OpenShift Workload Availability 5.7 | *, *, * |
| Red Hat | registry.redhat.io/workload-availability/node-maintenance-rhel9-operator@sha256:62f4b3e9b23ff60d3b955c395b5c87d4155fa307d076df7a3b1070e06096bb57_arm64 as a component of Red Hat OpenShift Workload Availability 5.7 | *, *, * |
| Red Hat | registry.redhat.io/workload-availability/node-maintenance-rhel9-operator@sha256:7c5a1e475fed819b8c9eac40640f7d9a6dd9ac80f8ddbc5b9bd60dc3efa2ee25_amd64 as a component of Red Hat OpenShift Workload Availability 5.7 | * |
| golang | ||
| Red Hat | registry.redhat.io/workload-availability/node-maintenance-operator-bundle@sha256:5d9fa0808c900246ef05e51d6de29c48c201c6e8b2e9cdec0f895ecb6ad26c03_amd64 as a component of Red Hat OpenShift Workload Availability 5.7 | *, *, * |
Timeline
- Aug 12, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54283 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54283.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
…and 35 more