VDB
RHSA-2026:54583
RHSA-2026:54583
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-snapshot-metadata-rhel9@sha256:dfa05c17f452e106aeaa44ab87eee623dac1998eb3f334e8df647ad183cc4385_s390x as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9-operator@sha256:daee7905397545507c704371237d0444b2544437246a104c0d1a6c0c1f4d6d9f_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-tools-rhel9@sha256:de376226fa45a84fab84a11db978708d3a10cfc9f01f3eb56731a08b299908f8_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-machine-controllers-rhel9@sha256:7114ee63ff1c18cd17bb1efb1630471c847cf7df92ceb7b853a402e5d0a328fb_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator@sha256:8c764daf6c95c6d9ab27c5723fa1e9c9ea671342865cff53d25d2e7775858f5f_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-service-ca-rhel9-operator@sha256:0f1359700936e84ea28c46331a4ffbf2e23c193d6cabcb35365c5285a2ab9183_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-docker-registry-rhel9@sha256:c16f06aa93fb23b9734b6cbdf5f4138b37202c37f13d9b1c349ee82413a91cfb_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel9@sha256:6cc1f4611079130ae569f800509ab9d23c267b51d6008636f2ec3e9323391f59_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-haproxy-router-rhel9@sha256:f50d257f1626e21ef61003c1364c8252df345040711ab9ce0ee069b4de35811a_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:9c69ec1b8c4a3c413bbf01cd119add2e10fbed35ce605c9469ac3b73008ac065_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-hyperkube-rhel9@sha256:8a14b86a504bffaf4e989d32a1993e0ea486202f88c21baef5c701f1d97b24cb_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-lifecycle-manager-rhel9@sha256:255956df0eb44b9a4ac1fefe489c9e99d39e5721ab006bdd88606f43ed96853e_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-olm-catalogd-rhel9@sha256:52685d880aa23e4e7daed781401fc330f08251de8979d04658fb2adfe4241a3a_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:3bdf437340c56b1fd06952c6e31d149be3204de8e12bd09dcac30fce466ac1ff_s390x as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/volume-data-source-validator-rhel9@sha256:849a7543ee82195434c1023b6ac6f12f432f0edb6f099971632353ebad28b9f9_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-api-rhel9@sha256:5b55973361c553d6e065bd4b9bb2663bf521b116b0dc02530d25fe01491d0831_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-machine-approver-rhel9@sha256:5719aff2aba10f9c4c35d8f6d15d2e6e4db3bfc2ab249d72bd42927eb3d72b12_s390x as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-installer-artifacts-rhel9@sha256:753282e6a24805bfe32d63cf1837d888ff6a25a08a3de5ce7dbbc2417a34a8d6_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9@sha256:7838f183018fab48f146778af701f1b01222b93fb4c515df4e43800eb8ca097f_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-block-csi-driver-rhel9@sha256:3a5c1640c86db6497df5d50fcc53e9f26397ce683c3abf3322e5cde94e276d80_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
…and 1309 more
Timeline
- Aug 18, 2026 CVE Published
- Sep 2, 2026 CVE Updated
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54583 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/cve/CVE-2026-42965 advisory
- https://access.redhat.com/security/cve/CVE-2026-44918 advisory
- https://access.redhat.com/security/cve/CVE-2026-50236 advisory
- https://access.redhat.com/security/cve/CVE-2026-50237 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54583.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467820 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39820 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39820 advisory
…and 24 more