VDB
RHSA-2026:59562
RHSA-2026:59562
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | osbuild-composer-debugsource-0:101.3-4.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-worker-0:101.3-4.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-0:101.3-4.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-core-0:101.3-4.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-0:101.3-4.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-debuginfo-0:101.3-4.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-debugsource-0:101.3-4.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-worker-0:101.3-4.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-0:101.3-4.el9_4.5.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-core-0:101.3-4.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-debuginfo-0:101.3-4.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-0:101.3-4.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-debuginfo-0:101.3-4.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-0:101.3-4.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-core-0:101.3-4.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-core-debuginfo-0:101.3-4.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
| Red Hat | osbuild-composer-debuginfo-0:101.3-4.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 101.3-4.el9, 101.3-4.el9, 101.3-4.el9 |
…and 13 more
Timeline
- Aug 25, 2026 CVE Published
- Sep 19, 2026 CVE Updated
- Sep 19, 2026 Distribution Patch
- Sep 19, 2026 Distribution Patch
- Sep 19, 2026 Security Advisory
- Sep 19, 2026 Security Advisory
- Sep 19, 2026 Security Advisory
- Sep 19, 2026 Security Advisory
- Sep 19, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:59562 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480762 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59562.json advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
…and 12 more