{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7385",
        "url": "https://access.redhat.com/errata/RHSA-2026:7385"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27141",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27141"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-58190",
        "url": "https://access.redhat.com/security/cve/CVE-2025-58190"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-47911",
        "url": "https://access.redhat.com/security/cve/CVE-2025-47911"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-22873",
        "url": "https://access.redhat.com/security/cve/CVE-2025-22873"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-68119",
        "url": "https://access.redhat.com/security/cve/CVE-2025-68119"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61732",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61732"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61731",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61731"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61725",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61725"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61724",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61724"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61723",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61723"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-58186",
        "url": "https://access.redhat.com/security/cve/CVE-2025-58186"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-58185",
        "url": "https://access.redhat.com/security/cve/CVE-2025-58185"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-58181",
        "url": "https://access.redhat.com/security/cve/CVE-2025-58181"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-47914",
        "url": "https://access.redhat.com/security/cve/CVE-2025-47914"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-47912",
        "url": "https://access.redhat.com/security/cve/CVE-2025-47912"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-47910",
        "url": "https://access.redhat.com/security/cve/CVE-2025-47910"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
        "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61730",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61730"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61729",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61729"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-58189",
        "url": "https://access.redhat.com/security/cve/CVE-2025-58189"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-58187",
        "url": "https://access.redhat.com/security/cve/CVE-2025-58187"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-58188",
        "url": "https://access.redhat.com/security/cve/CVE-2025-58188"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-58183",
        "url": "https://access.redhat.com/security/cve/CVE-2025-58183"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61728",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61728"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33809",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33809"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32289",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32289"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32288",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32288"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32283",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32283"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32282"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32281"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27144",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27144"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27143",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27143"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61727",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61727"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27139",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27139"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33813",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33813"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42503",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42503"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7385.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-05-16T08:36:50+00:00",
      "generator": {
        "date": "2026-05-16T08:36:50+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2026:7385",
      "initial_release_date": "2026-04-10T14:24:10+00:00",
      "revision_history": [
        {
          "date": "2026-04-10T14:24:10+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-07T03:11:40+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-16T08:36:50+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1-25-main@aarch64",
                "product": {
                  "name": "golang1-25-main@aarch64",
                  "product_id": "golang1-25-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.25@1.25.9-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1-25-main@src",
                "product": {
                  "name": "golang1-25-main@src",
                  "product_id": "golang1-25-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.25@1.25.9-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1-25-main@x86_64",
                "product": {
                  "name": "golang1-25-main@x86_64",
                  "product_id": "golang1-25-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.25@1.25.9-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1-25-main@noarch",
                "product": {
                  "name": "golang1-25-main@noarch",
                  "product_id": "golang1-25-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.25-docs@1.25.9-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1-25-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1-25-main@aarch64"
        },
        "product_reference": "golang1-25-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1-25-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1-25-main@noarch"
        },
        "product_reference": "golang1-25-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1-25-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1-25-main@src"
        },
        "product_reference": "golang1-25-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1-25-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1-25-main@x86_64"
        },
        "product_reference": "golang1-25-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22873",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-02-05T00:01:17.475869+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436992"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A path traversal vulnerability has been identified in the Go os package affecting the Root abstraction, where improper handling of trailing path separators could allow access to the parent directory of a configured root directory. By supplying a filename ending in \"../\", an attacker may be able to open the immediate parent directory of the intended Root. Although this escape does not allow traversal to higher-level ancestors or direct access to files within the parent directory, it may expose directory metadata or unintended filesystem structure if the application passes untrusted path input to Root.Open.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "os: os: Information disclosure via path traversal using specially crafted filenames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security classified this issue as Moderate.\n\nThe flaw exists in a local filesystem abstraction within the Go standard library, it can also be exploited remotely in applications that accept attacker-controlled path input over a network and pass it to Root.Open without proper validation. The attack complexity is low, as exploitation requires only appending \"../\" to the supplied path. However, the impact is limited: the flaw permits opening only the immediate parent directory, not arbitrary filesystem locations or files contained within that directory. There is no direct impact on file integrity or application availability. These constraints limit the practical exposure of the issue while still represents a boundary bypass and may expose unintended filesystem metadata. The issue does not permit traversal beyond the parent directory, modification of files, or broader system compromise, thereby constraining its overall impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-22873"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436992",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436992"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-22873",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22873"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-22873",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22873"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2025/05/06/2",
          "url": "http://www.openwall.com/lists/oss-security/2025/05/06/2"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/670036",
          "url": "https://go.dev/cl/670036"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/73555",
          "url": "https://go.dev/issue/73555"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ",
          "url": "https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4403",
          "url": "https://pkg.go.dev/vuln/GO-2026-4403"
        }
      ],
      "release_date": "2026-02-04T23:05:24.803000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "os: os: Information disclosure via path traversal using specially crafted filenames"
    },
    {
      "cve": "CVE-2025-47910",
      "cwe": {
        "id": "CWE-440",
        "name": "Expected Behavior Violation"
      },
      "discovery_date": "2025-09-22T22:00:44.572202+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2397528"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A CrossOriginProtection bypass has been discovered in the golang net/http package. When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: CrossOriginProtection bypass in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-47910"
        },
        {
          "category": "external",
          "summary": "RHBZ#2397528",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397528"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-47910",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47910"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47910",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47910"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/699275",
          "url": "https://go.dev/cl/699275"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75054",
          "url": "https://go.dev/issue/75054"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ",
          "url": "https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3955",
          "url": "https://pkg.go.dev/vuln/GO-2025-3955"
        }
      ],
      "release_date": "2025-09-22T21:01:55.440000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: CrossOriginProtection bypass in net/http"
    },
    {
      "cve": "CVE-2025-47911",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-02-05T18:01:23.423406+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437109"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437109",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437109"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-47911",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47911",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/vulndb/issues/4440",
          "url": "https://github.com/golang/vulndb/issues/4440"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709876",
          "url": "https://go.dev/cl/709876"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c",
          "url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4440",
          "url": "https://pkg.go.dev/vuln/GO-2026-4440"
        }
      ],
      "release_date": "2026-02-05T17:48:44.562000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html"
    },
    {
      "cve": "CVE-2025-47912",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2025-10-29T23:01:06.642219+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407247"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Insufficient validation of bracketed IPv6 hostnames in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-47912"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407247",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407247"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-47912",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47912"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47912",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47912"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709857",
          "url": "https://go.dev/cl/709857"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75678",
          "url": "https://go.dev/issue/75678"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4010",
          "url": "https://pkg.go.dev/vuln/GO-2025-4010"
        }
      ],
      "release_date": "2025-10-29T22:10:13.435000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/url: Insufficient validation of bracketed IPv6 hostnames in net/url"
    },
    {
      "cve": "CVE-2025-47914",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-11-19T21:01:06.202641+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2416000"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SSH Agent servers component (golang.org/x/crypto/ssh/agent). This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a specially crafted, malformed message during new identity requests. The server fails to validate the size of these messages, leading to an out-of-bounds read that can cause the program to panic and terminate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. The golang.org/x/crypto/ssh/agent library, when used in SSH Agent servers, does not properly validate the size of messages during new identity requests. A specially crafted malformed message can lead to an out-of-bounds read, causing the program to panic and resulting in a denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-47914"
        },
        {
          "category": "external",
          "summary": "RHBZ#2416000",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416000"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-47914",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47914"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47914",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47914"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/721960",
          "url": "https://go.dev/cl/721960"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76364",
          "url": "https://go.dev/issue/76364"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA",
          "url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4135",
          "url": "https://pkg.go.dev/vuln/GO-2025-4135"
        }
      ],
      "release_date": "2025-11-19T20:33:43.126000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages"
    },
    {
      "cve": "CVE-2025-58181",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-11-19T21:00:50.197590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2415997"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/crypto/ssh. An attacker can exploit this vulnerability by sending specially crafted GSSAPI (Generic Security Service Application Program Interface) authentication requests to an SSH (Secure Shell) server. The server fails to validate the number of mechanisms specified in these requests, leading to unbounded memory consumption. This can result in a Denial of Service (DoS), making the SSH server unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat. SSH servers utilizing `golang.org/x/crypto/ssh` and configured to process GSSAPI authentication requests are susceptible to unbounded memory consumption. An attacker can exploit this by sending specially crafted GSSAPI authentication requests, potentially leading to a denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "RHBZ#2415997",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2415997"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58181",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58181",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/721961",
          "url": "https://go.dev/cl/721961"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76363",
          "url": "https://go.dev/issue/76363"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA",
          "url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4134",
          "url": "https://pkg.go.dev/vuln/GO-2025-4134"
        }
      ],
      "release_date": "2025-11-19T20:33:42.795000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication"
    },
    {
      "cve": "CVE-2025-58183",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-10-29T23:01:50.573951+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go program to try to allocate a large amount of memory, causing an out-of-memory condition and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: archive/tar: Unbounded allocation when parsing GNU sparse map",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to be able to process a specially crafted GNU tar pax 1.0 archive with the application using the archive/tar package. Additionally, this issue can cause the Go application to allocate a large amount of memory, eventually leading to an out-of-memory condition and resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58183"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58183",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58183"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709861",
          "url": "https://go.dev/cl/709861"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75677",
          "url": "https://go.dev/issue/75677"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4014",
          "url": "https://pkg.go.dev/vuln/GO-2025-4014"
        }
      ],
      "release_date": "2025-10-29T22:10:14.376000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: archive/tar: Unbounded allocation when parsing GNU sparse map"
    },
    {
      "cve": "CVE-2025-58185",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-10-29T23:01:25.877898+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407251"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory exhaustion flaw has been discovered in the golang encoding/asn1 module. Within parseSequenceOf, reflect.MakeSlice is being used to pre-allocate a slice that is needed in order to fully validate the given DER payload. The size of the slice allocated are also multiple times larger than the input DER. As a result, a malicious actor can craft a big empty DER payload, resulting in an unnecessary large allocation of memories. This can be a way to cause memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58185"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407251",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407251"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58185",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58185"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58185",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58185"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/commit/8709a41d5ef7321f486a1857f189c3fee20e8edd",
          "url": "https://github.com/golang/go/commit/8709a41d5ef7321f486a1857f189c3fee20e8edd"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709856",
          "url": "https://go.dev/cl/709856"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75671",
          "url": "https://go.dev/issue/75671"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4011",
          "url": "https://pkg.go.dev/vuln/GO-2025-4011"
        }
      ],
      "release_date": "2025-10-29T22:10:13.682000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1"
    },
    {
      "cve": "CVE-2025-58186",
      "discovery_date": "2025-10-29T23:01:22.260983+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407250"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407250",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407250"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58186"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709855",
          "url": "https://go.dev/cl/709855"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75672",
          "url": "https://go.dev/issue/75672"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4012",
          "url": "https://pkg.go.dev/vuln/GO-2025-4012"
        }
      ],
      "release_date": "2025-10-29T22:10:13.912000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http"
    },
    {
      "cve": "CVE-2025-58187",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-10-29T23:01:54.130980+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407259"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A potential denial of service flaw has been discovered in golang\u0027s crypto/x509 module. Due to the design of the name constraint checking algorithm, the processing time of some inputs scales non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: Quadratic complexity when checking name constraints in crypto/x509",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58187"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407259",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407259"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58187",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58187"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58187",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58187"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/commit/3fc4c79fdbb17b9b29ea9f8c29dd780df075d4c4",
          "url": "https://github.com/golang/go/commit/3fc4c79fdbb17b9b29ea9f8c29dd780df075d4c4"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709854",
          "url": "https://go.dev/cl/709854"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75681",
          "url": "https://go.dev/issue/75681"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4007",
          "url": "https://pkg.go.dev/vuln/GO-2025-4007"
        }
      ],
      "release_date": "2025-10-29T22:10:12.624000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/x509: Quadratic complexity when checking name constraints in crypto/x509"
    },
    {
      "cve": "CVE-2025-58188",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2025-10-29T23:01:39.787633+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407255"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service vector has been discovered in the golang crypto/x509 module. An attacker could craft an intermediate X.509 certificate containing a DSA public key and can crash a remote host with an unauthenticated call to any endpoint that verifies the certificate chain.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Availability impacts are limited on Red Hat products as they do not affect the host systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58188"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407255",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407255"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58188",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58188"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58188",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58188"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/commit/6e4007e8cffbb870e6b606307ab7308236ecefb9",
          "url": "https://github.com/golang/go/commit/6e4007e8cffbb870e6b606307ab7308236ecefb9"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709853",
          "url": "https://go.dev/cl/709853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75675",
          "url": "https://go.dev/issue/75675"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4013",
          "url": "https://pkg.go.dev/vuln/GO-2025-4013"
        }
      ],
      "release_date": "2025-10-29T22:10:14.143000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509"
    },
    {
      "cve": "CVE-2025-58189",
      "cwe": {
        "id": "CWE-117",
        "name": "Improper Output Neutralization for Logs"
      },
      "discovery_date": "2025-10-29T23:01:57.740310+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407260"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which can contain arbitrary attacker controlled information provided by the client-side of the connection which is not escaped. This affects programs which log these errors without any additional form of sanitization, and may allow injection of attacker controlled information into logs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58189"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407260",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407260"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58189",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58189"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58189",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58189"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/707776",
          "url": "https://go.dev/cl/707776"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75652",
          "url": "https://go.dev/issue/75652"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4008",
          "url": "https://pkg.go.dev/vuln/GO-2025-4008"
        }
      ],
      "release_date": "2025-10-29T22:10:12.947000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information"
    },
    {
      "cve": "CVE-2025-58190",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-02-05T18:01:26.511908+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437110"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) in an exposed go application if an attacker provides specially crafted HTML content.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: Infinite parsing loop in golang.org/x/net",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437110",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437110"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58190",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58190",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/vulndb/issues/4441",
          "url": "https://github.com/golang/vulndb/issues/4441"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709875",
          "url": "https://go.dev/cl/709875"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c",
          "url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4441",
          "url": "https://pkg.go.dev/vuln/GO-2026-4441"
        }
      ],
      "release_date": "2026-02-05T17:48:44.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/html: Infinite parsing loop in golang.org/x/net"
    },
    {
      "cve": "CVE-2025-61723",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-10-29T23:01:29.304260+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407252"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A potential denial of service flaw has been discovered in the golang encoding/pem module. Due to the design of the PEM parsing function, the processing time for some\ninputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs and may result in an unresponsive program should an attacker exploit it.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61723"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407252",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407252"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61723",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61723"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61723",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61723"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/commit/5ce8cd16f3859ec5ac4106ad8ec15d6236f4501b",
          "url": "https://github.com/golang/go/commit/5ce8cd16f3859ec5ac4106ad8ec15d6236f4501b"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709858",
          "url": "https://go.dev/cl/709858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75676",
          "url": "https://go.dev/issue/75676"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4009",
          "url": "https://pkg.go.dev/vuln/GO-2025-4009"
        }
      ],
      "release_date": "2025-10-29T22:10:13.220000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem"
    },
    {
      "cve": "CVE-2025-61724",
      "cwe": {
        "id": "CWE-1046",
        "name": "Creation of Immutable Text Using String Concatenation"
      },
      "discovery_date": "2025-10-29T23:01:47.202663+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407257"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61724"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407257",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407257"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61724",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61724"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61724",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61724"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709859",
          "url": "https://go.dev/cl/709859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75716",
          "url": "https://go.dev/issue/75716"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4015",
          "url": "https://pkg.go.dev/vuln/GO-2025-4015"
        }
      ],
      "release_date": "2025-10-29T22:10:14.609000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto"
    },
    {
      "cve": "CVE-2025-61725",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-10-29T23:01:18.805163+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407249"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service vulnerability has been discovered in the golang net/mail module. The ParseAddress function constructed domain-literal address components through repeated string concatenation which when parsing large domain-literal components, could cause excessive CPU consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: Excessive CPU consumption in ParseAddress in net/mail",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61725"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407249",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407249"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61725",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61725"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61725",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61725"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709860",
          "url": "https://go.dev/cl/709860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75680",
          "url": "https://go.dev/issue/75680"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4006",
          "url": "https://pkg.go.dev/vuln/GO-2025-4006"
        }
      ],
      "release_date": "2025-10-29T22:10:12.255000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/mail: Excessive CPU consumption in ParseAddress in net/mail"
    },
    {
      "cve": "CVE-2025-61726",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:42.791305+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736712",
          "url": "https://go.dev/cl/736712"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77101",
          "url": "https://go.dev/issue/77101"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4341",
          "url": "https://pkg.go.dev/vuln/GO-2026-4341"
        }
      ],
      "release_date": "2026-01-28T19:30:31.215000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "cve": "CVE-2025-61727",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2025-12-03T20:01:21.730501+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418677"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/x509 package in the Go standard library. This vulnerability allows a certificate validation bypass via an excluded subdomain constraint in a certificated chain as it does not restrict the usage of wildcard SANs in the leaf certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to obtain a leaf certificate with a wildcard SAN (e.g., *.example.com) and the legitimate certificate policy must contain an excluded DNS name constraint (e.g., to prevent issuance for test.example.com), allowing an application using the crypto/x509 package to validate the certificate when it should have been rejected and to be vulnerable to MITM (man-in-the-middle) attacks. Additionally, the attacker does not have full control of what data can be read of modified during the attack. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61727"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418677",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418677"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61727",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61727"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61727",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61727"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/723900",
          "url": "https://go.dev/cl/723900"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76442",
          "url": "https://go.dev/issue/76442"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
          "url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4175",
          "url": "https://pkg.go.dev/vuln/GO-2025-4175"
        }
      ],
      "release_date": "2025-12-03T19:37:15.054000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs"
    },
    {
      "cve": "CVE-2025-61728",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:39.965024+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736713",
          "url": "https://go.dev/cl/736713"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77102",
          "url": "https://go.dev/issue/77102"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4342",
          "url": "https://pkg.go.dev/vuln/GO-2026-4342"
        }
      ],
      "release_date": "2026-01-28T19:30:31.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
    },
    {
      "cve": "CVE-2025-61729",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2025-12-02T20:01:45.330964+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418462"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418462",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418462"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61729",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/725920",
          "url": "https://go.dev/cl/725920"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76445",
          "url": "https://go.dev/issue/76445"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
          "url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4155",
          "url": "https://pkg.go.dev/vuln/GO-2025-4155"
        }
      ],
      "release_date": "2025-12-02T18:54:10.166000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "cve": "CVE-2025-61730",
      "cwe": {
        "id": "CWE-325",
        "name": "Missing Cryptographic Step"
      },
      "discovery_date": "2026-01-28T20:01:36.508659+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434430"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The data leak after exploitation of this vulnerability is minor, data such as Handshake message contents that should have been processed only after switching to a stronger TLS 1.3 encryption level, Protocol state details such as which handshake message was processed when, Timing and ordering information about the TLS 1.3 state.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61730"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434430",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434430"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61730",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61730"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61730",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61730"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/724120",
          "url": "https://go.dev/cl/724120"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76443",
          "url": "https://go.dev/issue/76443"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4340",
          "url": "https://pkg.go.dev/vuln/GO-2026-4340"
        }
      ],
      "release_date": "2026-01-28T19:30:30.986000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls"
    },
    {
      "cve": "CVE-2025-61731",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-01-28T20:01:45.587773+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434433"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in cmd/go. An attacker can exploit this by building a malicious Go source file that uses the \u0027#cgo pkg-config:\u0027 directive. This allows the attacker to write to an arbitrary file with partial control over its content, by providing a \u0027--log-file\u0027 argument to the pkg-config command. This vulnerability can lead to arbitrary file write.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is Important rather than Moderate because compiling a malicious Go source file can cause `pkg-config` to create or append data to files at attacker-chosen locations, subject to the permissions of the build user. This can enable unintended filesystem modifications during the build process, which can lead to broken builds, alter tool behavior, and poison caches or artifacts, even without direct code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61731"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434433",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434433"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61731",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61731"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61731",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61731"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736711",
          "url": "https://go.dev/cl/736711"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77100",
          "url": "https://go.dev/issue/77100"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4339",
          "url": "https://pkg.go.dev/vuln/GO-2026-4339"
        }
      ],
      "release_date": "2026-01-28T19:30:30.844000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive"
    },
    {
      "cve": "CVE-2025-61732",
      "discovery_date": "2026-02-05T05:00:47.678207+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437016"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s \u0027cgo tool\u0027. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then \"smuggled\" into the compiled `cgo` binary. An attacker could exploit this to embed and execute arbitrary code, potentially leading to significant system compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in the `cmd/cgo` component of the Go toolchain. A parsing discrepancy between Go and C/C++ comments could allow for code smuggling into the resulting `cgo` binary. This primarily affects systems where untrusted Go modules utilizing `cgo` are built, impacting Red Hat Enterprise Linux and OpenShift Container Platform.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61732"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437016",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437016"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61732",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61732"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61732",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61732"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/734220",
          "url": "https://go.dev/cl/734220"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76697",
          "url": "https://go.dev/issue/76697"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4433",
          "url": "https://pkg.go.dev/vuln/GO-2026-4433"
        }
      ],
      "release_date": "2026-02-05T03:42:26.392000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy"
    },
    {
      "cve": "CVE-2025-68119",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-01-28T20:01:57.098669+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434438"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Golang\u0027s cmd/go module. This vulnerability allows a local attacker to achieve local code execution by downloading and building modules with specially crafted malicious version strings. On systems with Mercurial (hg) installed, this can occur when downloading modules from non-standard sources due to how external Version Control System (VCS) commands are constructed. Additionally, on systems with Git installed, providing malicious version strings to the toolchain can enable an attacker to write to arbitrary files on the filesystem. This issue is triggered by explicitly supplying these malicious version strings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/go: cmd/go: Local code execution and arbitrary file write via malicious module version strings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate severity by Red Hat Product Security, because exploitation requires non-standard and intentional user behavior. \n\nThe attacker must explicitly supply a specially crafted module version string, which does not occur during normal Go module usage such as @latest or standard module paths, making the attack complexity high. \n\nAdditionally, user interaction is required, as the vulnerable behavior is only triggered when a user manually invokes the Go toolchain to download or build the malicious module.\n \nWhile successful exploitation can result in local code execution or arbitrary file modification, the combination of local access, manual input, and uncommon usage patterns significantly limits the likelihood of exploitation in typical environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68119"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434438",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434438"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68119",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68119"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68119",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68119"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736710",
          "url": "https://go.dev/cl/736710"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77099",
          "url": "https://go.dev/issue/77099"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4338",
          "url": "https://pkg.go.dev/vuln/GO-2026-4338"
        }
      ],
      "release_date": "2026-01-28T19:30:30.704000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cmd/go: cmd/go: Local code execution and arbitrary file write via malicious module version strings"
    },
    {
      "cve": "CVE-2025-68121",
      "discovery_date": "2026-02-05T18:01:30.086058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/737700",
          "url": "https://go.dev/cl/737700"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77217",
          "url": "https://go.dev/issue/77217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4337",
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "release_date": "2026-02-05T17:48:44.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "cve": "CVE-2026-25679",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-03-06T22:02:11.567841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752180",
          "url": "https://go.dev/cl/752180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77578",
          "url": "https://go.dev/issue/77578"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4601",
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "release_date": "2026-03-06T21:28:14.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "cve": "CVE-2026-27139",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-03-06T22:01:08.670782+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A path traversal flaw has been discovered in the golang `os` module. On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "os: FileInfo can escape from a Root in golang os module",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27139"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27139",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27139"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27139",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27139"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/749480",
          "url": "https://go.dev/cl/749480"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77827",
          "url": "https://go.dev/issue/77827"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4602",
          "url": "https://pkg.go.dev/vuln/GO-2026-4602"
        }
      ],
      "release_date": "2026-03-06T21:28:14.451000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "os: FileInfo can escape from a Root in golang os module"
    },
    {
      "cve": "CVE-2026-27141",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-02-26T20:09:11.626155+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443104"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/http2. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames, which are data packets used in the HTTP/2 protocol. Due to a missing check for null values, processing these specific frames (types 0x0a through 0x0f) can cause the server to crash. This leads to a Denial of Service (DoS) condition, making the affected server unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443104",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443104"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/746180",
          "url": "https://go.dev/cl/746180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77652",
          "url": "https://go.dev/issue/77652"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4559",
          "url": "https://pkg.go.dev/vuln/GO-2026-4559"
        }
      ],
      "release_date": "2026-02-26T18:50:31.830000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames"
    },
    {
      "cve": "CVE-2026-27143",
      "cwe": {
        "id": "CWE-733",
        "name": "Compiler Optimization Removal or Modification of Security-critical Code"
      },
      "discovery_date": "2026-04-08T02:01:29.491546+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially leading to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: cmd/compile: possible memory corruption after bound check elimination",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is only exploitable in applications that contain a loop structure that relies on an induction variable. An induction variable is a variable that gets modified, usually incremented or decremented, by a predictable amount on each iteration. Inside the loop, the induction variable must be directly used as the index to access or modify elements within an array or a slice. Additionally, an attacker must be able to cause an integer overflow or underflow in the induction variable to trigger this issue. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27143"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27143",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27143"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27143",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27143"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763765",
          "url": "https://go.dev/cl/763765"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78333",
          "url": "https://go.dev/issue/78333"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4868",
          "url": "https://pkg.go.dev/vuln/GO-2026-4868"
        }
      ],
      "release_date": "2026-04-08T01:06:57.168000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, strictly sanitize and enforce bounds checking on any untrusted user input that influences loop counters, iteration limits, or memory indices. If there is no integer overflow or underflow, the out-of-bounds access cannot occur.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: cmd/compile: possible memory corruption after bound check elimination"
    },
    {
      "cve": "CVE-2026-27144",
      "cwe": {
        "id": "CWE-440",
        "name": "Expected Behavior Violation"
      },
      "discovery_date": "2026-04-08T02:01:22.896153+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456340"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data corruption, memory corruption or unexpected application behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: cmd/compile: no-op interface conversion bypasses overlap checking",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is only exploitable in applications that contain a memory move or copy operation that is subject to a no-op (no-operation) interface conversion. Furthermore, the source and destination memory addresses involved in the move or copy must overlap and an attacker must be able to supply an input that triggers this specific operation. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27144"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456340",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456340"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27144",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27144"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27144",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27144"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763764",
          "url": "https://go.dev/cl/763764"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78371",
          "url": "https://go.dev/issue/78371"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4867",
          "url": "https://pkg.go.dev/vuln/GO-2026-4867"
        }
      ],
      "release_date": "2026-04-08T01:06:56.908000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, review code that performs memory copies or struct assignments. If data is being passed through an interface (such as \u0027any\u0027 or \u0027interface{}\u0027) just before a move operation, refactor the code to use concrete types or explicit pointers instead.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: cmd/compile: no-op interface conversion bypasses overlap checking"
    },
    {
      "cve": "CVE-2026-32281",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-04-08T02:01:00.930989+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456333"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456333",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758061",
          "url": "https://go.dev/cl/758061"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78281",
          "url": "https://go.dev/issue/78281"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4946",
          "url": "https://pkg.go.dev/vuln/GO-2026-4946"
        }
      ],
      "release_date": "2026-04-08T01:06:58.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "cve": "CVE-2026-32282",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-04-08T02:01:12.683211+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763761",
          "url": "https://go.dev/cl/763761"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78293",
          "url": "https://go.dev/issue/78293"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4864",
          "url": "https://pkg.go.dev/vuln/GO-2026-4864"
        }
      ],
      "release_date": "2026-04-08T01:06:55.953000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
    },
    {
      "cve": "CVE-2026-32283",
      "cwe": {
        "id": "CWE-764",
        "name": "Multiple Locks of a Critical Resource"
      },
      "discovery_date": "2026-04-08T02:01:16.213799+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763767",
          "url": "https://go.dev/cl/763767"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78334",
          "url": "https://go.dev/issue/78334"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4870",
          "url": "https://pkg.go.dev/vuln/GO-2026-4870"
        }
      ],
      "release_date": "2026-04-08T01:06:57.670000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "cve": "CVE-2026-32288",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-08T02:00:57.624222+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456332"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s `archive/tar` package. A remote attacker could exploit this vulnerability by providing a maliciously-crafted archive file. When the `tar.Reader` processes an archive containing a large number of sparse regions in the \"old GNU sparse map\" format, it can lead to unbounded memory allocation. This can result in a Denial of Service (DoS) condition, making the affected application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "archive/tar: golang: Go\u0027s archive/tar package: Denial of Service via maliciously-crafted archive",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32288"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456332",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456332"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32288",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32288"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32288",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32288"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763766",
          "url": "https://go.dev/cl/763766"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78301",
          "url": "https://go.dev/issue/78301"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4869",
          "url": "https://pkg.go.dev/vuln/GO-2026-4869"
        }
      ],
      "release_date": "2026-04-08T01:06:57.416000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "archive/tar: golang: Go\u0027s archive/tar package: Denial of Service via maliciously-crafted archive"
    },
    {
      "cve": "CVE-2026-32289",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-04-08T02:01:05.911683+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456334"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be incorrectly or improperly escaped, leading to Cross-Site Scripting (XSS) vulnerabilities. This could allow an attacker to inject malicious scripts into web pages viewed by other users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32289"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456334",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456334"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32289",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32289"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32289",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32289"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763762",
          "url": "https://go.dev/cl/763762"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78331",
          "url": "https://go.dev/issue/78331"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4865",
          "url": "https://pkg.go.dev/vuln/GO-2026-4865"
        }
      ],
      "release_date": "2026-04-08T01:06:56.297000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals"
    },
    {
      "cve": "CVE-2026-33809",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-03-25T19:01:55.384019+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451437"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/image/tiff. A remote attacker could exploit this vulnerability by providing a maliciously crafted Tagged Image File Format (TIFF) file. This could cause the image decoding process to attempt to allocate up to 4 gigabytes (GiB) of memory. The excessive resource consumption or an out-of-memory error would lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via maliciously crafted TIFF file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33809"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451437",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451437"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33809",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33809"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33809",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33809"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/757660",
          "url": "https://go.dev/cl/757660"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78267",
          "url": "https://go.dev/issue/78267"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4815",
          "url": "https://pkg.go.dev/vuln/GO-2026-4815"
        }
      ],
      "release_date": "2026-03-25T18:24:04.222000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via maliciously crafted TIFF file"
    },
    {
      "cve": "CVE-2026-33813",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-21T20:01:02.224363+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460221"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted WEBP image with an invalid, large size. This could cause the application to panic and crash on 32-bit platforms, leading to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1-25-main@aarch64",
          "Red Hat Hardened Images:golang1-25-main@noarch",
          "Red Hat Hardened Images:golang1-25-main@src",
          "Red Hat Hardened Images:golang1-25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33813"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460221",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460221"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33813",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33813"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33813",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33813"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/759860",
          "url": "https://go.dev/cl/759860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78407",
          "url": "https://go.dev/issue/78407"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4961",
          "url": "https://pkg.go.dev/vuln/GO-2026-4961"
        }
      ],
      "release_date": "2026-04-21T19:21:27.644000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T14:24:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1-25-main@aarch64",
            "Red Hat Hardened Images:golang1-25-main@noarch",
            "Red Hat Hardened Images:golang1-25-main@src",
            "Red Hat Hardened Images:golang1-25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing"
    }
  ]
}