VDB
RHSA-2026:54441
RHSA-2026:54441
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator@sha256:1ccd0a4e337d93f9b3a45b03328016e8f4738033c69335f6b6d62eb8ae52eb22_s390x as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | *, *, * |
| Red Hat | registry.redhat.io/rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator@sha256:715794cf99699a378ed29f336692b82c70c9ba8b18e10c1b572510ec646318ab_ppc64le as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | *, *, * |
| Red Hat | registry.redhat.io/rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator@sha256:ed4bc7c60b2dee49a5ac71f15936324a039638669266b644899cc70c6225c527_arm64 as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | *, *, * |
| Red Hat | registry.redhat.io/rh-lightspeed-runtimes/runtimes-inventory-operator-bundle@sha256:2769366b1658bf14b727560d72529517c5d0c0e6982c756d50878b1845c3215e_amd64 as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | *, *, * |
| Red Hat | registry.redhat.io/rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator@sha256:1764d020e1189c01f154dcf82c554f6bd7f95ba4377c2a47976053c46dc7e1e9_amd64 as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | *, *, * |
Timeline
- Aug 12, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw advisory
- https://pkg.go.dev/vuln/GO-2026-5037 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33811 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33811 advisory
- https://go.dev/cl/767860 advisory
- https://go.dev/issue/78803 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
- https://pkg.go.dev/vuln/GO-2026-4981 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39821 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39821 advisory
- https://go.dev/cl/767220 advisory
- https://go.dev/issue/78760 advisory
- https://pkg.go.dev/vuln/GO-2026-5026 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480762 issue
- https://www.cve.org/CVERecord?id=CVE-2026-42502 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42502 advisory
- https://go.dev/cl/781701 advisory
- https://go.dev/issue/79572 advisory
…and 28 more