VDB
RHSA-2026:74429
RHSA-2026:74429
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-config-reloader-rhel9@sha256:47ac19a1c906c3b16be49627b4467c83f680dc6c59669f863b40e6e57f3e5826_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator@sha256:193c94758dacb9611998a6bcc60840cfc2744a2a758522cb83fe57b2acd00a4f_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:53db2336b53bb39c9c4266928bcc66c24aaafa6778dc0bc0e793a07fd96b497f_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-tools-rhel9@sha256:1955c796ee4a0302ce59a0034663d720cb90d905b3d62ba29623f5178a4f24e3_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/volume-data-source-validator-rhel9@sha256:5726b6e3a5229c3648cda7d54df2e15de116fa79de1f867e54fcbfcf1501ccab_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ibm-vpc-block-csi-driver-rhel9@sha256:95f9d5d6d346671c14ff6b06a9ee89195609004cc14c74b25c09f7e633452340_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-bootstrap-rhel9@sha256:b693fef8bd1214b2de7ea7f6a867ded721acee9c4d28ee4b7eb112940d309853_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-resizer-rhel9@sha256:548b7c4a2c748ba526830683b50ac783ce29bede5eda2c1d38b9fbbaeec5069e_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-apiserver-rhel9@sha256:a9590d71df00d8f7f45f6a4c6c34d058b1880ae300d1c3199f946469df33ade6_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-pod-rhel9@sha256:a410e7142bdf6f9ffb2e70d2bd2b84d5c6700278b112316a595a045e47a6bdd3_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-rhel9-operator@sha256:d655d54832725a417a0d793317d782d6de43afc4419d10b43b02abb8a98bdb0c_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-snapshot-metadata-rhel9@sha256:ce46af8740a8b9035d7505bd4bfa079976bdb63906b9d0159abb147e96274278_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:e5b2b29045f3265428e6249c823b2a8cdc32e60a7045aeb7d0d727750c0ed720_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-openshift-apiserver-rhel9-operator@sha256:688f33b7e72efbd33c03cd65c46c926566303af37892897bb5a06988cf073895_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/insights-runtime-extractor-rhel9@sha256:606cce865fd418f77121b5c61e8da1c6a2640ab47e88aef8121a170b3859e48c_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-console-rhel9@sha256:8bc93fb91878dcf50bcbf873ec2bdea469f81b5383ce2f8ef9268d283bdf100a_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:063e4e0c5f22afba963e058d1c1d310ef95dc0a057176832b1fe76328ff6f5f6_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-lifecycle-manager-rhel9@sha256:a627269f346ca34b70ca7402205445409ef4dd74d6ee6c957668a88a7c9a6f35_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-deployer-rhel9@sha256:f55f2f2c8724f8e39c627b40f7cfe8b3de88e3e5b35822a99cec046643c3988d_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-os-images-rhel9@sha256:d2ed033609de31efd21a777db5dc7ca7b4a0cdbd588b3119b17d5a96c86dcd15_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
…and 635 more
Timeline
- Oct 6, 2026 CVE Published
- Oct 8, 2026 CVE Updated
- Oct 8, 2026 Distribution Patch
- Oct 8, 2026 Distribution Patch
- Oct 8, 2026 Security Advisory
- Oct 8, 2026 Security Advisory
- Oct 8, 2026 Security Advisory
- Oct 8, 2026 Security Advisory
- Oct 8, 2026 Security Advisory
- Oct 8, 2026 Security Advisory
- Oct 8, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:74429 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-49329 advisory
- https://access.redhat.com/security/cve/CVE-2026-67213 advisory
- https://access.redhat.com/security/cve/CVE-2026-83589 advisory
- https://access.redhat.com/security/cve/CVE-2026-96577 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74429.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
…and 19 more