VDB
RHSA-2026:74383
RHSA-2026:74383
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-operator-lifecycle-manager-rhel9@sha256:17f1f4c49e89d8cb9108c025a9058cb186e46b03020fb5ba4c4066c74b2f9244_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-resizer-rhel9@sha256:bb4b86f7397d152e538c50148b586a2831751ffc2266558676a36a7b8179aa23_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/network-tools-rhel9@sha256:1e56fedd775199534a9d448987950ef57bdf0efaefbc2f6760611dd7b301df87_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-hyperkube-rhel9@sha256:70496e18ba83d60101d40442c76d5c14c97dadeb7677a13c71d03da80f44f47e_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-console-rhel9@sha256:d78cb991fa23bcac5ca1fd04db9c267295f5f0402a8bfc842ce15312299bd9ab_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-olm-catalogd-rhel9@sha256:d7d9ac67b3d58c939c6e8ae28128e9b69dbf08dc52ad5ad974e54a81d6094a39_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/insights-runtime-extractor-rhel9@sha256:3166f0e7d6e10a8041f90965995503372217c87ab56ff3039de134cb3f872b55_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-olm-rhel9-operator@sha256:612e2c7c9d8603ea297c9e369f337bf3bb92858483fe31dae5d04e7ef29fd1c1_s390x as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-apiserver-rhel9@sha256:7a91d6c0eddf2351525050c3b14fbc95db2c1fc95233db5ddac67b8d613ee72a_s390x as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:ebdeb88f76571201017614e79b343fc168a928e55ae3b7544f4e8905352e3140_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:f041014debc8a5babf7a4d39ba61d95477039bcfad11b7a82cc0d253502f894c_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel9@sha256:de77b8a3bd5c3fdf07d408ee5e21511c0b8325af647585f61ad9e17b55fe1763_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:99c27cbabbf25ccadff84418a5934967b86afcde3950c6c455d6b23830b6ae34_s390x as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:829c187f54c09aa08ff1362bfd7b5fcd419ce59aedb4872d00a0aa5bd3a28399_s390x as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-installer-artifacts-rhel9@sha256:b650496ac3c413052f7d29ab9d6e5f99e11e665167f0ce11a8aad975ed5c120a_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:4815a3ef7cef522aac783cc9664cec93534c417536224b9fa4c177ddd933607e_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-must-gather-rhel9@sha256:9e907b0f81f958eea077c06e1703f88b666f2ae9c2b0242520026974071517af_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel9@sha256:48435fa98b83be6f9c2efe5a7459a10124961f13d79822d88dc66c564fe8e05d_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator@sha256:e1eb265270e9911052f88f6fa1f3f423589c4db58aaa942595bcdbc277e86cad_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:98e66aa71b42bc33482deb72bcb6193f463325b517c5a5ac9749a3e1abbf86a8_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
…and 631 more
Timeline
- Oct 6, 2026 CVE Published
- Oct 7, 2026 CVE Updated
- Oct 7, 2026 Distribution Patch
- Oct 7, 2026 Distribution Patch
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
- Oct 7, 2026 Security Advisory
References
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
- https://go.dev/cl/761640 advisory
- https://go.dev/issue/78476 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
- https://pkg.go.dev/vuln/GO-2026-4918 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39821 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39821 advisory
- https://go.dev/cl/767220 advisory
- https://go.dev/issue/78760 advisory
- https://pkg.go.dev/vuln/GO-2026-5026 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2483248 issue
- https://www.cve.org/CVERecord?id=CVE-2026-49329 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-49329 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2508406 issue
…and 26 more