VDB
RHSA-2026:59560
RHSA-2026:59560
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | osbuild-composer-core-debuginfo-0:132.2-11.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-debuginfo-0:132.2-11.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-debuginfo-0:132.2-11.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-core-0:132.2-11.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-worker-0:132.2-11.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-debugsource-0:132.2-11.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-0:132.2-11.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-worker-debuginfo-0:132.2-11.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-worker-0:132.2-11.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-core-debuginfo-0:132.2-11.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-core-0:132.2-11.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-debugsource-0:132.2-11.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-0:132.2-11.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-debuginfo-0:132.2-11.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-debugsource-0:132.2-11.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-core-0:132.2-11.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-core-0:132.2-11.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-debuginfo-0:132.2-11.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-worker-0:132.2-11.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
| Red Hat | osbuild-composer-0:132.2-11.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 132.2-11.el9, 132.2-11.el9, 132.2-11.el9 |
…and 13 more
Timeline
- Aug 25, 2026 CVE Published
- Sep 19, 2026 CVE Updated
- Sep 19, 2026 Distribution Patch
- Sep 19, 2026 Distribution Patch
- Sep 19, 2026 Security Advisory
- Sep 19, 2026 Security Advisory
- Sep 19, 2026 Security Advisory
- Sep 19, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:59560 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480762 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59560.json advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
…and 5 more