RHSA-2026:75863 | Vulnetix

RHSA-2026:75863 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:7b44934f0b358883f5e787d8d7416c799da094172c491fac1597f0f2c65b7a67_s390x as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/kubemacpool-rhel9@sha256:7bd5c3ff62e13e78a2c1d7488e24a90f4a4b7fb1d337715ff4e6ba72016ef961_arm64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/kubemacpool-rhel9@sha256:be1e2df68637ef725f7c80ae044084dac7d372dbda1eb7f2dec641ec154ed605_amd64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:46a9eabc2c546068bf2c9279bcfe84519875c8f4f8799c1afbf02b67027d5043_s390x as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:314c0ed7a5c55b6f56d264c549bda8d1cb54179bd663bcb3792a53435a3ee141_arm64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/multus-dynamic-networks-rhel9@sha256:b6157908f9157d61aabc040aff7a96657ecc8032187b79891939a758cb55f0d2_amd64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/kubesecondarydns-rhel9@sha256:3ce3f57d4feb087e70745825de888277519787146f588fc8fbd9b5b6233414c3_arm64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/multus-dynamic-networks-rhel9@sha256:80a3f2469d90ab3dfc6f6f60947e4f2e5e6b6b2029cc4d9e8f10defb2d19f4f8_s390x as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/kubemacpool-rhel9@sha256:15e7ae611cb75c2a46886eb2dcb2f3906d7149d9d4226292e9395523e8358769_s390x as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/kubesecondarydns-rhel9@sha256:817065e36eeccf973563db7ea3da2ec89137ac83dd0a18dd7a440983fc345c6c_amd64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:f10ae3ba63026b57dd5198dad29ef9f08e3c9adeacc78231de0f80ea3b060ddc_arm64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/kubesecondarydns-rhel9@sha256:738dfa0ab874d4ac1217e966fbd179ebc953a2a71f9ec4959734a84c2cbc2b5c_s390x as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:d00702511d7f582777c1890ff4ec3f1e1c782204a773928dc6c385b097264085_amd64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/bridge-marker-rhel9@sha256:ed9e5f4e984c32d57929d11c36951b748f592f3835f7ad09eb36a711cc6bb6ed_arm64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/ovs-cni-plugin-rhel9@sha256:f85adf0feca29be7a45f6c3e07cd8a941f1d9b25f02291bfadfd9e1abd073e83_arm64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/multus-dynamic-networks-rhel9@sha256:51fbc68be727bf57307e301cca11222ffa908c24c69e7b53018292eb0b8d4795_arm64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/bridge-marker-rhel9@sha256:e4354752da52e03df90a3248ced8d133aba40346de60ff6b96df954f867e331c_s390x as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/kubevirt-ipam-controller-rhel9@sha256:7a23f1cb7041bd1997ae8472a38abf8bd30582197a03aafb0be245e9ed60dd23_arm64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:01dc819fcfae78c6ea3c44e7ff0c9c3ab38ed24119f41f18e4a528cbd87262f9_amd64 as a component of Red Hat Container Native Virtualization 4.21	*
Red Hat	registry.redhat.io/container-native-virtualization/kubevirt-ipam-controller-rhel9@sha256:97f8d2acea6e635435a232059f548decabc5fd25d6a8d7da1679c80c465bfe25_amd64 as a component of Red Hat Container Native Virtualization 4.21	*

…and 4 more

Timeline

Oct 5, 2026 CVE Published
Oct 8, 2026 CVE Updated
Oct 8, 2026 Distribution Patch
Oct 8, 2026 Distribution Patch
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:75863 advisory
https://access.redhat.com/security/cve/CVE-2026-56858 advisory
https://access.redhat.com/security/cve/CVE-2026-56859 advisory
https://access.redhat.com/security/cve/CVE-2026-56860 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75863.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515838 issue
https://www.cve.org/CVERecord?id=CVE-2026-56858 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56858 advisory
https://go.dev/cl/807100 advisory
https://go.dev/issue/80435 advisory
https://groups.google.com/g/golang-announce/c/94pEornpRlI advisory
https://pkg.go.dev/vuln/GO-2026-6091 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515840 issue
https://www.cve.org/CVERecord?id=CVE-2026-56859 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56859 advisory
https://go.dev/cl/803320 advisory
https://go.dev/issue/80481 advisory
https://pkg.go.dev/vuln/GO-2026-6088 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515820 issue

…and 5 more

Open in Interactive Console →