VDB
RHSA-2026:54288
RHSA-2026:54288
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x as a component of Compliance Operator 1 | * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 as a component of OpenShift File Integrity Operator - FIO 1 | * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x as a component of File Integrity Operator 1 | *, *, * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 as a component of OpenShift File Integrity Operator - FIO 1 | * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le as a component of OpenShift File Integrity Operator - FIO 1 | * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x as a component of OpenShift File Integrity Operator - FIO 1 | * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le as a component of Compliance Operator 1 | * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le as a component of File Integrity Operator 1 | *, *, * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 as a component of File Integrity Operator 1 | *, *, * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 as a component of File Integrity Operator 1 | *, *, * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 as a component of Compliance Operator 1 | * |
| Red Hat | registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 as a component of Compliance Operator 1 | * |
Timeline
- Aug 12, 2026 CVE Published
- Sep 9, 2026 CVE Updated
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54288 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-32281 advisory
- https://access.redhat.com/security/cve/CVE-2026-32282 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54288.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2456333 issue
- https://www.cve.org/CVERecord?id=CVE-2026-32281 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-32281 advisory
- https://go.dev/cl/758061 advisory
…and 29 more