RHSA-2026:54531 | Vulnetix

RHSA-2026:54531 PUBLISHED CVSS 7.099999904632568 HIGH

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.

Risk Scores

CVSS 3.1

7.099999904632568

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:a16ba6a9cb55a5c6e0743cf8d38742c346c22518e02c1e045b017bed380863b6_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.19	, , *
Red Hat	registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:60f97a1218b94ccb0e21bb5677bf906be3369b79ff81fa35050de1f4385027da_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.19	, , *
Red Hat	registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:b574ad0711134be333ae87c25dcc910c5f4847ce454779eda9ea0125230777f3_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.19	, , *
Red Hat	registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:5074228e3df2095b082e468b4c99d285203313133e208ca1893b2ae966fbee90_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.19	*
Google	golang.org/x/net/html
Red Hat
golang.org/x/net	golang.org/x/net/html
Red Hat	registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:79091d478d6c09140474f2707e4dad555f393c9bdc866d567265b747ad7cc9a4_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.19	*
Red Hat	registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6dd44adc300558e1a9bee074347bc394e9335de4cab7ca3a32cc8a403cdad5dd_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.19	, , *
Red Hat	cert-manager Operator for Red Hat OpenShift

Red Hat	registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:0e4493d95443c137e4fe2e5b81cdf3d6a9b7b5d74c9162c3f32909a331dc07f2_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.19	, , *
Red Hat	registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:82461a011b7698c367b21a0866ac8c73a44fb3d5f21527cb34ed1495383207c2_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.19	, , *

Timeline

Aug 13, 2026 CVE Published
Sep 30, 2026 CVE Updated
Sep 30, 2026 Distribution Patch
Sep 30, 2026 Distribution Patch
Sep 30, 2026 Security Advisory
Sep 30, 2026 Security Advisory
Sep 30, 2026 Security Advisory
Sep 30, 2026 Security Advisory
Sep 30, 2026 Security Advisory
Sep 30, 2026 Security Advisory
Sep 30, 2026 Security Advisory
Sep 30, 2026 Security Advisory

References

https://bugzilla.redhat.com/show_bug.cgi?id=2480684 issue
https://www.cve.org/CVERecord?id=CVE-2026-39830 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39830 advisory
https://go.dev/cl/781640 advisory
https://go.dev/cl/781664 advisory
https://go.dev/issue/79564 advisory
https://pkg.go.dev/vuln/GO-2026-5017 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467809 issue
https://www.cve.org/CVERecord?id=CVE-2026-42499 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42499 advisory
https://go.dev/cl/771520 advisory
https://go.dev/issue/78987 advisory
https://pkg.go.dev/vuln/GO-2026-4977 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2480762 issue
https://www.cve.org/CVERecord?id=CVE-2026-42502 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42502 advisory
https://go.dev/cl/781701 advisory
https://go.dev/issue/79572 advisory
https://pkg.go.dev/vuln/GO-2026-5027 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2484204 issue

…and 78 more

Open in Interactive Console →