VDB
RHSA-2026:74430
RHSA-2026:74430
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:0366556088b30f1de90473e2fb4df444755cbf8ede9ba202fef9e2c9a3c227c0_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:9b96d6fa6d56b5af4ac36fe2cba1b73af296585d6b89f54f8abeab66a17d781e_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:a3b538b35232cba11e4a2548420d3bd17f63bc7d1e6da3204ba762b5e77da3f6_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:e2639d6512d4fcc9a6dff482f985fa7af78416d2dc668382ac933b2600be36d4_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:073bd0a6109b679062bb55498a591a016bd27b028e16c6c72e25979ecc7b447b_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:94549c59a825982be1645d8e8c565c8767a9f5e929af2279be8317dac4b1b164_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9@sha256:3855da64515f93aff5f99afe6b7edc2fb19e471071dfa5b663a443a32c4f0041_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:9ef0112123e08a21c49203c0d112f0ccd5c47b70c7d207f9a3804ec12cf05311_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:882fabc0840905dded60ae45d195faa605bdbf3f5fc4c44cc53c028b531a9619_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:4597cbaf50210f9fc08ac1590905788da3e0bf88386bee5ed147f99008295f3f_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-support-log-gather-rhel9-operator@sha256:bf50ec21f0969866e1b30f5c9a2beb0503ce51b28b319aaf17539fb8212529ef_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:e521edce0e78866b38980b097f92e3d929721bfa73bd078c088f14ad50845df4_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:ba2b45f33c7ca7306217214ee9e45b179bbcc767bdc554e85cd733b754761d4b_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:8c690efeeaa87196c28a4bd83fa6bc682b3dfd25471aad4f483284fb6d25ea1f_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:6ca578b1714e3037998bcf40277551595211fa2330fdc7008b9e1acff9296e2a_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:03b8288e778d19ab932d1dfc36352042401c5d1715b9704d8e680065c69930cc_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9@sha256:f18a7f0725ab3b2e773555e27f193439087d81d77d45ee811cf7bbe4e040c97a_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:d7f8cf9c754fb0b59a12ded195631236ed8d10b108589d2bb7cdfb4979e96887_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:367bb1a737a67c652c953bbc25307c46be3b9bfc1533f1c3f864db9bf5e85c55_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:98c29a17a517a8b7a7bb2a55a8e362682d0aff64cf15156902478d4156d18046_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
…and 150 more
Timeline
- Oct 6, 2026 CVE Published
- Oct 26, 2026 CVE Updated
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:74430 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-84445 advisory
- https://access.redhat.com/security/cve/CVE-2026-87114 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74430.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2533175 issue
- https://www.cve.org/CVERecord?id=CVE-2026-84445 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84445 advisory
- https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7 advisory
- https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4 advisory
- https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f advisory
- https://github.com/grpc/grpc-go/issues/9354 advisory
…and 9 more