VDB
RHSA-2026:74381
RHSA-2026:74381
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:d4370618805d53eed4682d6a673aee90a3956523f4580713f2b35afa273f3c7f_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:7a9b17ec751815a6f50b58f797b76839fa60f1e361857e9b979eb5c7f6c47a21_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9-operator@sha256:f177da27447a3c6ff04d1d52b86be18bf5681e135b4b0c33df0b9446fa881771_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:05ed1394a60bce12d512e6e695a45a1a710ddfd7df7d24d8596093d90f99b79a_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9@sha256:33b8d4fcbda4aeb3b9e90868b7ef5cbdc43b680392395290e0f2614752cf8831_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9@sha256:899d4c252c35ded042154e0783431e20cd5a50d16dbe7899adb88b06c1fc4a17_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:0235a9e2213b505795d4a3eba7864007800e4e57f3e9bcecf1821aef71b6a578_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9@sha256:06e7627f6b2d9a3afda07e7ba26bc03dc236aef4b9e48ad98e0bbe0f2617aeb5_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:3ef7956001234a8482d6435b9d114864e431b0c3b1043a73351d44fb75b7e916_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/pf-status-relay-rhel9@sha256:37f5926e52609a96d0b166eaac605b4e3aece5bde2a923e8f23bc24130aa5ba9_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:dd72518841cc150fc6411fde8e1dc812a742551ce035b3eadb15627d2419c234_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9-operator@sha256:4498e3c6fee53e7c2aca8d9d7d05aac9a98d3fa48f934ebe7829a5e8a32771c1_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:e8eb88909ddf1907af82fddf4639c39b9f4ec7ddf6e6a456d4b65ce2dc4a95c9_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:c5dca738109f2d7b707f314f17f8271843d6968bcd837326c2fad3671798be47_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:8b25a5d41124882459f1f7f5fab32fd622d8e0e008e618c97165d28a433eb9a4_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9@sha256:6fdbb9937d5ee36b6ced746223a373ff07345857814dc9971cde769838e48999_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:0186a04c08f4d4f44b36328978278c2cd0aa808f63b046ee21bbfa886c11af65_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:03b21a89853e884a7f8868bb9db4daab1c191d318fa694c7673ee7b111151659_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:e6a1af5daed1bde1b2119fa872c86ea1c5a3c65065dc346f845c3fb63c70300b_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9-operator@sha256:671414fc9769e2ceb5dac5650ec7d3ce8b0c962c8eb68bd48d38e2a51c064e07_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
…and 141 more
Timeline
- Oct 6, 2026 CVE Published
- Oct 7, 2026 CVE Updated
- Oct 7, 2026 Distribution Patch
- Oct 7, 2026 Distribution Patch
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:74381 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-75931 advisory
- https://access.redhat.com/security/cve/CVE-2026-87114 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74381.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
- https://go.dev/cl/761640 advisory
- https://go.dev/issue/78476 advisory
…and 10 more