RHSA-2026:59467 | Vulnetix

RHSA-2026:59467 PUBLISHED CVSS 8.199999809265137 HIGH

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.

Risk Scores

CVSS 3.1

8.199999809265137

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x as a component of OpenShift API for Data Protection 1.4	*
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 as a component of OpenShift API for Data Protection 1.4	*
Red Hat	registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le as a component of OpenShift API for Data Protection 1.4	*
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x as a component of OpenShift API for Data Protection 1.4	*
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x as a component of OpenShift API for Data Protection 1.4	*
Red Hat	registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x as a component of OpenShift API for Data Protection 1.4	*
Red Hat	registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 as a component of OpenShift API for Data Protection 1.4	, , *
Red Hat	registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le as a component of OpenShift API for Data Protection 1.4	, , *
Google	golang.org/x/net/html

…and 28 more

Timeline

Aug 25, 2026 CVE Published
Sep 9, 2026 Security Advisory
Sep 22, 2026 CVE Updated
Sep 22, 2026 Distribution Patch
Sep 22, 2026 Distribution Patch
Sep 22, 2026 Security Advisory
Sep 22, 2026 Security Advisory
Sep 22, 2026 Security Advisory
Sep 22, 2026 Security Advisory
Sep 22, 2026 Security Advisory
Sep 22, 2026 Security Advisory
Sep 22, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:59467 advisory
https://access.redhat.com/security/cve/CVE-2026-25681 advisory
https://access.redhat.com/security/cve/CVE-2026-27136 advisory
https://access.redhat.com/security/cve/CVE-2026-33811 advisory
https://access.redhat.com/security/cve/CVE-2026-39820 advisory
https://access.redhat.com/security/cve/CVE-2026-39828 advisory
https://access.redhat.com/security/cve/CVE-2026-39829 advisory
https://access.redhat.com/security/cve/CVE-2026-39830 advisory
https://access.redhat.com/security/cve/CVE-2026-39831 advisory
https://access.redhat.com/security/cve/CVE-2026-39835 advisory
https://access.redhat.com/security/cve/CVE-2026-42306 advisory
https://access.redhat.com/security/cve/CVE-2026-42499 advisory
https://access.redhat.com/security/cve/CVE-2026-42502 advisory
https://access.redhat.com/security/cve/CVE-2026-42508 advisory
https://access.redhat.com/security/cve/CVE-2026-44740 advisory
https://access.redhat.com/security/cve/CVE-2026-46595 advisory
https://access.redhat.com/security/cve/CVE-2026-46597 advisory
https://access.redhat.com/security/cve/CVE-2026-53488 advisory
https://access.redhat.com/security/cve/CVE-2026-53492 advisory
https://access.redhat.com/security/cve/CVE-2026-71235 advisory

…and 114 more

Open in Interactive Console →