VDB
RHSA-2026:54527
RHSA-2026:54527
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:3df44c7ce6c8247cc36a057d48015803177dd651b10b74c6e80f43755afffa0a_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.19 | * |
| golang | golang.org/x/net/html | |
| Red Hat | registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:3df44c7ce6c8247cc36a057d48015803177dd651b10b74c6e80f43755afffa0a_arm64 | |
| Red Hat | registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:6468289d06d9d44dccfd3928b7ae6fc7faa5748572357367d04a20d6403df8fa_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.19 | * |
| Red Hat | registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:4bc4f32e99ffff3a93dce000e9cb36c2cee6d576049bb36d5d91c8afda5eabad_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.19 | * |
| golang.org/x/net | golang.org/x/net/html | |
| Red Hat | registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a32782599959e25eb2174dc87ea0d9e3a9c6daebf4f1fd6c4fb9204a10af885d_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.19 | * |
Timeline
- Aug 13, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54527 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54527.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
…and 6 more