JsBraceDepth Context Tracking Bugs (XSS) in html/template
Published Apr 8, 2026
6.1
MEDIUMCVSS 3.1
EPSS 0.33%
Description
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
Affected products
-
- Version 0StatusaffectedConstraints<1.25.9
- Version 1.26.0-0StatusaffectedConstraints<1.26.2
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Go standard library | Html/template | unaffected |
|
No data.
Red Hat Enterprise Linux 9
golang-0:1.26.2-1.el9_8
Fixed · RHSA-2026:19181
Red Hat Hardened Images
golang1-25-main-1.25.9-1.hum1
Fixed · RHSA-2026:7385
Red Hat Hardened Images
golang1-26-main-1.26.2-1.hum1
Fixed · RHSA-2026:7291
Assisted Installer for Red Hat OpenShift Container Platform 2
redhat-user-workloads/appliance
Fix deferred
Builds for Red Hat OpenShift
redhat-user-workloads/openshift-builds-waiter-1-6
Fix deferred
Builds for Red Hat OpenShift
redhat-user-workloads/openshift-builds-waiter-1-7
Fix deferred
Compliance Operator
redhat-user-workloads/compliance-operator-bundle-release
Fix deferred
Confidential Compute Attestation
redhat-user-workloads/osc-caa
Fix deferred
Confidential Compute Attestation
redhat-user-workloads/trustee-operator
Fix deferred
Cryostat 4
cryostat/cryostat-storage-rhel9
Fix deferred
Custom Metric Autoscaler operator for Red Hat Openshift
redhat-user-workloads/keda-adapter
Fix deferred
Deployment Validation Operator
redhat-user-workloads/deployment-validation-operator
Fix deferred
External Secrets Operator for Red Hat OpenShift
external-secrets-operator/external-secrets-rhel9
Fix deferred
ExternalDNS Operator
edo/external-dns-rhel8
Fix deferred
ExternalDNS Operator
edo/external-dns-rhel9
Fix deferred
File Integrity Operator
redhat-user-workloads/file-integrity-operator-release
Fix deferred
Gatekeeper 3
redhat-user-workloads/gatekeeper-operator-3-18
Fix deferred
Gatekeeper 3
redhat-user-workloads/gatekeeper-operator-3-20
Fix deferred
Logging Subsystem for Red Hat OpenShift
redhat-user-workloads/art-images
Fix deferred
Logging Subsystem for Red Hat OpenShift
redhat-user-workloads/logging-loki-v6-0
Fix deferred
Logging Subsystem for Red Hat OpenShift
redhat-user-workloads/logging-loki-v6-2
Fix deferred
Logging Subsystem for Red Hat OpenShift
redhat-user-workloads/logging-loki-v6-4
Fix deferred
Logical Volume Manager Storage
lvms4/topolvm-rhel8
Fix deferred
Logical Volume Manager Storage
lvms4/topolvm-rhel9
Fix deferred
Logical Volume Manager Storage
redhat-user-workloads/lvm-operator
Fix deferred
Migration Toolkit for Applications 8
mta/mta-cli-rhel9
Fix deferred
Migration Toolkit for Applications 8
redhat-user-workloads/art-images
Fix deferred
Migration Toolkit for Containers
redhat-user-workloads/art-images
Fix deferred
Multiarch Tuning Operator
redhat-user-workloads/multiarch-tuning-operator-v1-x
Fix deferred
Multicluster Engine for Kubernetes
redhat-user-workloads/kube-rbac-proxy-mce-210
Fix deferred
Multicluster Engine for Kubernetes
redhat-user-workloads/kube-rbac-proxy-mce-211
Fix deferred
Multicluster Engine for Kubernetes
redhat-user-workloads/kube-rbac-proxy-mce-26
Fix deferred
Multicluster Engine for Kubernetes
redhat-user-workloads/kube-rbac-proxy-mce-27
Fix deferred
Multicluster Engine for Kubernetes
redhat-user-workloads/kube-rbac-proxy-mce-28
Fix deferred
Multicluster Engine for Kubernetes
redhat-user-workloads/kube-rbac-proxy-mce-29
Fix deferred
Multicluster Global Hub
multicluster-globalhub/multicluster-globalhub-agent-rhel8
Fix deferred
Multicluster Global Hub
multicluster-globalhub/multicluster-globalhub-agent-rhel9
Fix deferred
Multicluster Global Hub
multicluster-globalhub/multicluster-globalhub-grafana-rhel9
Fix deferred
Network Observability Operator
redhat-user-workloads/flowlogs-pipeline-zstream
Fix deferred
OpenShift API for Data Protection
redhat-user-workloads/art-images
Fix deferred
OpenShift Developer Tools and Services
helm
Fix deferred
OpenShift Lightspeed
redhat-user-workloads/openshift-mcp-server
Fix deferred
OpenShift Pipelines
openshift-pipelines-client
Fix deferred
OpenShift Serverless
kn-workflow-plugin
Fix deferred
OpenShift Serverless
openshift-serverless-clients
Fix deferred
OpenShift Serverless
redhat-user-workloads/kn-plugin-event-sender
Fix deferred
OpenShift Service Mesh 2
openshift-golang-builder-container
Fix deferred
OpenShift Service Mesh 2
redhat-user-workloads/kiali-2-6
Fix deferred
OpenShift Service Mesh 3
openshift-golang-builder-container
Fix deferred
OpenShift Service Mesh 3
redhat-user-workloads/kiali-3-0
Fix deferred
OpenShift Service Mesh 3
redhat-user-workloads/kiali-3-1
Fix deferred
OpenShift Service Mesh 3
redhat-user-workloads/kiali-3-2
Fix deferred
OpenShift Service Mesh 3
redhat-user-workloads/kiali-3-3
Fix deferred
Power monitoring for Red Hat OpenShift
redhat-user-workloads/kepler
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp2/3scale-rhel7-operator
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp2/3scale-rhel9-operator
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
redhat-user-workloads/volsync-0-13
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
redhat-user-workloads/volsync-0-14
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
redhat-user-workloads/volsync-0-15
Fix deferred
Red Hat Advanced Cluster Security 4
rhacs-eng/release-main
Fix deferred
Red Hat Ansible Automation Platform 2
automation-gateway-proxy
Fix deferred
Red Hat Ansible Automation Platform 2
automation-gateway-proxy-openssl30
Fix deferred
Red Hat Ansible Automation Platform 2
automation-gateway-proxy-openssl32
Fix deferred
Red Hat Ansible Automation Platform 2
receptor
Fix deferred
Red Hat Ansible Automation Platform 2
redhat-user-workloads/receptor-rhel9
Fix deferred
Red Hat Ceph Storage 5
rhceph-ci/grafana
Fix deferred
Red Hat Ceph Storage 6
rhceph-ci/grafana
Fix deferred
Red Hat Certification Program for Red Hat Enterprise Linux 9
redhat-certification-preflight
Fix deferred
Red Hat Connectivity Link 1
redhat-user-workloads/rhcl-1-3-coredns
Fix deferred
Red Hat Developer Hub
rhdh/rhdh-rhel9-operator
Fix deferred
Red Hat Edge Manager 1
flightctl
Fix deferred
Red Hat Edge Manager 1
redhat-user-workloads/flightctl-api
Fix deferred
Red Hat Enterprise Linux 10
buildah
Fix deferred
Red Hat Enterprise Linux 10
delve
Fix deferred
Red Hat Enterprise Linux 10
go-fdo-client
Fix deferred
Red Hat Enterprise Linux 10
go-fdo-server
Fix deferred
Red Hat Enterprise Linux 10
golang
Fix deferred
Red Hat Enterprise Linux 10
grafana
Fix deferred
Red Hat Enterprise Linux 10
grafana-pcp
Fix deferred
Red Hat Enterprise Linux 10
gvisor-tap-vsock
Fix deferred
Red Hat Enterprise Linux 10
ignition
Fix deferred
Red Hat Enterprise Linux 10
image-builder
Fix deferred
Red Hat Enterprise Linux 10
opentelemetry-collector
Fix deferred
Red Hat Enterprise Linux 10
osbuild-composer
Fix deferred
Red Hat Enterprise Linux 10
podman
Fix deferred
Red Hat Enterprise Linux 10
skopeo
Fix deferred
Red Hat Enterprise Linux 10
toolbox
Fix deferred
Red Hat Enterprise Linux 10
trustee
Fix deferred
Red Hat Enterprise Linux 10
trustee-guest-components
Fix deferred
Red Hat Enterprise Linux 7
rhc
Fix deferred
Red Hat Enterprise Linux 7
rhc-worker-script
Fix deferred
Red Hat Enterprise Linux 8
container-tools:rhel8/buildah
Fix deferred
Red Hat Enterprise Linux 8
container-tools:rhel8/conmon
Fix deferred
Red Hat Enterprise Linux 8
container-tools:rhel8/containernetworking-plugins
Fix deferred
Red Hat Enterprise Linux 8
container-tools:rhel8/podman
Fix deferred
Red Hat Enterprise Linux 8
container-tools:rhel8/skopeo
Fix deferred
Red Hat Enterprise Linux 8
container-tools:rhel8/toolbox
Fix deferred
Red Hat Enterprise Linux 8
go-toolset:rhel8/go-toolset
Fix deferred
Red Hat Enterprise Linux 8
go-toolset:rhel8/golang
Fix deferred
Red Hat Enterprise Linux 8
grafana
Fix deferred
Red Hat Enterprise Linux 8
grafana-pcp
Fix deferred
Red Hat Enterprise Linux 8
osbuild-composer
Fix deferred
Red Hat Enterprise Linux 8
rhc
Fix deferred
Red Hat Enterprise Linux 9
buildah
Fix deferred
Red Hat Enterprise Linux 9
conmon
Fix deferred
Red Hat Enterprise Linux 9
containernetworking-plugins
Fix deferred
Red Hat Enterprise Linux 9
go-toolset
Out of support scope
Red Hat Enterprise Linux 9
grafana
Fix deferred
Red Hat Enterprise Linux 9
grafana-pcp
Fix deferred
Red Hat Enterprise Linux 9
gvisor-tap-vsock
Fix deferred
Red Hat Enterprise Linux 9
ignition
Fix deferred
Red Hat Enterprise Linux 9
image-builder
Fix deferred
Red Hat Enterprise Linux 9
opentelemetry-collector
Fix deferred
Red Hat Enterprise Linux 9
osbuild-composer
Fix deferred
Red Hat Enterprise Linux 9
podman
Fix deferred
Red Hat Enterprise Linux 9
rhc
Fix deferred
Red Hat Enterprise Linux 9
skopeo
Fix deferred
Red Hat Enterprise Linux 9
toolbox
Fix deferred
Red Hat Enterprise Linux 9
trustee-guest-components
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
golang
Fix deferred
Red Hat JBoss Web Server 6
jboss-webserver/jws-rhel9-operator
Fix deferred
Red Hat Lightspeed for Runtimes Operator
redhat-user-workloads/runtimes-inventory-operator
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-rhel8-operator
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-rhel9-operator
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-trainer-rhel9
Fix deferred
Red Hat OpenShift Cluster Manager CLI
redhat-user-workloads/ocm-cli
Fix deferred
Red Hat OpenShift Container Platform 4
conmon
Fix deferred
Red Hat OpenShift Container Platform 4
containernetworking-plugins
Fix deferred
Red Hat OpenShift Container Platform 4
cri-o
Fix deferred
Red Hat OpenShift Container Platform 4
cri-tools
Fix deferred
Red Hat OpenShift Container Platform 4
ignition
Fix deferred
Red Hat OpenShift Container Platform 4
kata-containers
Fix deferred
Red Hat OpenShift Container Platform 4
microshift
Fix deferred
Red Hat OpenShift Container Platform 4
openshift
Fix deferred
Red Hat OpenShift Container Platform 4
openshift-clients
Fix deferred
Red Hat OpenShift Container Platform 4
openshift-golang-builder-container
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/frr-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-node
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-sdn-rhel7
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-sdn-rhel8
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-sdn-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
ose-aws-ecr-image-credential-provider
Fix deferred
Red Hat OpenShift Container Platform 4
ose-azure-acr-image-credential-provider
Fix deferred
Red Hat OpenShift Container Platform 4
ose-gcp-gcr-image-credential-provider
Fix deferred
Red Hat OpenShift Container Platform 4
podman
Fix deferred
Red Hat OpenShift Container Platform 4
redhat-user-workloads/art-images
Fix deferred
Red Hat OpenShift Container Platform 4
skopeo
Fix deferred
Red Hat OpenShift Dev Spaces
redhat-user-workloads/udi-rhel9
Fix deferred
Red Hat OpenShift Dev Workspaces Operator
redhat-user-workloads/devworkspace-rhel9-operator
Fix deferred
Red Hat OpenShift GitOps
redhat-user-workloads/dex-rhel8
Fix deferred
Red Hat OpenShift GitOps
redhat-user-workloads/dex-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
cnv-tech-preview/virt-api
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/virt-api
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/virt-api-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
kubevirt
Fix deferred
Red Hat OpenShift Virtualization 4
openshift-golang-builder-container
Fix deferred
Red Hat OpenShift distributed tracing 3
redhat-user-workloads/tempo
Fix deferred
Red Hat OpenShift for Windows Containers
redhat-user-workloads/windows-machine-config-operator-release-4-18
Fix deferred
Red Hat OpenShift for Windows Containers
redhat-user-workloads/windows-machine-config-operator-release-4-19
Fix deferred
Red Hat OpenShift for Windows Containers
redhat-user-workloads/windows-machine-config-operator-release-4-20
Fix deferred
Red Hat OpenShift for Windows Containers
redhat-user-workloads/windows-machine-config-operator-release-4-21
Fix deferred
Red Hat OpenShift on AWS
rosa
Fix deferred
Red Hat OpenStack Platform 16.2
etcd
Fix deferred
Red Hat OpenStack Platform 16.2
redhat-user-workloads/osp-director-agent
Fix deferred
Red Hat OpenStack Platform 17.1
etcd
Fix deferred
Red Hat OpenStack Platform 17.1
redhat-user-workloads/osp-director-agent
Fix deferred
Red Hat OpenStack Platform 18.0
golang-github-openstack-k8s-operators-os-diff
Fix deferred
Red Hat OpenStack Platform 18.0
redhat-user-workloads/ovn-operator
Fix deferred
Red Hat Openshift Data Foundation 4
ocs4/cephcsi-rhel8
Fix deferred
Red Hat Openshift Data Foundation 4
odf4/cephcsi-rhel8
Fix deferred
Red Hat Openshift Data Foundation 4
odf4/cephcsi-rhel9
Fix deferred
Red Hat Openshift Data Foundation 4
rhceph-dev/odf4-cephcsi-rhel9
Fix deferred
Red Hat Quay 3
redhat-user-workloads/quay-quay-v3-10
Fix deferred
Red Hat Quay 3
redhat-user-workloads/quay-quay-v3-12
Fix deferred
Red Hat Quay 3
redhat-user-workloads/quay-quay-v3-13
Fix deferred
Red Hat Quay 3
redhat-user-workloads/quay-quay-v3-14
Fix deferred
Red Hat Quay 3
redhat-user-workloads/quay-quay-v3-15
Fix deferred
Red Hat Quay 3
redhat-user-workloads/quay-quay-v3-16
Fix deferred
Red Hat Quay 3
redhat-user-workloads/quay-quay-v3-17
Fix deferred
Red Hat Quay 3
redhat-user-workloads/quay-quay-v3-9
Fix deferred
Red Hat Satellite 6
redhat-user-workloads/iop-ingress-sat-6-18
Fix deferred
Red Hat Satellite 6
satellite:el8/yggdrasil-worker-forwarder
Fix deferred
Red Hat Satellite 6
yggdrasil-worker-forwarder
Fix deferred
Red Hat Service Interconnect 1
skupper-cli
Fix deferred
Red Hat Service Interconnect 2
skupper-cli
Fix deferred
Red Hat Trusted Artifact Signer
redhat-user-workloads/cli-v08
Fix deferred
Red Hat Trusted Artifact Signer
securesign/gitsign
Fix deferred
Security Profiles Operator
redhat-user-workloads/security-profiles-operator-release
Fix deferred
Zero Trust Workload Identity Manager
redhat-user-workloads/spiffe-csi-driver-0-2-8
Fix deferred
Zero Trust Workload Identity Manager - Tech Preview
redhat-user-workloads/spiffe-spire-agent-1-12-4
Fix deferred
cert-manager Operator for Red Hat OpenShift
redhat-user-workloads/jetstack-cert-manager-1-17
Fix deferred
cert-manager Operator for Red Hat OpenShift
redhat-user-workloads/jetstack-cert-manager-1-18
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 9 | golang-0:1.26.2-1.el9_8 | Fixed | RHSA-2026:19181 |
| Red Hat Hardened Images | golang1-25-main-1.25.9-1.hum1 | Fixed | RHSA-2026:7385 |
| Red Hat Hardened Images | golang1-26-main-1.26.2-1.hum1 | Fixed | RHSA-2026:7291 |
| Assisted Installer for Red Hat OpenShift Container Platform 2 | redhat-user-workloads/appliance | Fix deferred | n/a |
| Builds for Red Hat OpenShift | redhat-user-workloads/openshift-builds-waiter-1-6 | Fix deferred | n/a |
| Builds for Red Hat OpenShift | redhat-user-workloads/openshift-builds-waiter-1-7 | Fix deferred | n/a |
| Compliance Operator | redhat-user-workloads/compliance-operator-bundle-release | Fix deferred | n/a |
| Confidential Compute Attestation | redhat-user-workloads/osc-caa | Fix deferred | n/a |
| Confidential Compute Attestation | redhat-user-workloads/trustee-operator | Fix deferred | n/a |
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Fix deferred | n/a |
| Custom Metric Autoscaler operator for Red Hat Openshift | redhat-user-workloads/keda-adapter | Fix deferred | n/a |
| Deployment Validation Operator | redhat-user-workloads/deployment-validation-operator | Fix deferred | n/a |
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-rhel9 | Fix deferred | n/a |
| ExternalDNS Operator | edo/external-dns-rhel8 | Fix deferred | n/a |
| ExternalDNS Operator | edo/external-dns-rhel9 | Fix deferred | n/a |
| File Integrity Operator | redhat-user-workloads/file-integrity-operator-release | Fix deferred | n/a |
| Gatekeeper 3 | redhat-user-workloads/gatekeeper-operator-3-18 | Fix deferred | n/a |
| Gatekeeper 3 | redhat-user-workloads/gatekeeper-operator-3-20 | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | redhat-user-workloads/art-images | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | redhat-user-workloads/logging-loki-v6-0 | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | redhat-user-workloads/logging-loki-v6-2 | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | redhat-user-workloads/logging-loki-v6-4 | Fix deferred | n/a |
| Logical Volume Manager Storage | lvms4/topolvm-rhel8 | Fix deferred | n/a |
| Logical Volume Manager Storage | lvms4/topolvm-rhel9 | Fix deferred | n/a |
| Logical Volume Manager Storage | redhat-user-workloads/lvm-operator | Fix deferred | n/a |
| Migration Toolkit for Applications 8 | mta/mta-cli-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Applications 8 | redhat-user-workloads/art-images | Fix deferred | n/a |
| Migration Toolkit for Containers | redhat-user-workloads/art-images | Fix deferred | n/a |
| Multiarch Tuning Operator | redhat-user-workloads/multiarch-tuning-operator-v1-x | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | redhat-user-workloads/kube-rbac-proxy-mce-210 | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | redhat-user-workloads/kube-rbac-proxy-mce-211 | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | redhat-user-workloads/kube-rbac-proxy-mce-26 | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | redhat-user-workloads/kube-rbac-proxy-mce-27 | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | redhat-user-workloads/kube-rbac-proxy-mce-28 | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | redhat-user-workloads/kube-rbac-proxy-mce-29 | Fix deferred | n/a |
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-agent-rhel8 | Fix deferred | n/a |
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-agent-rhel9 | Fix deferred | n/a |
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Fix deferred | n/a |
| Network Observability Operator | redhat-user-workloads/flowlogs-pipeline-zstream | Fix deferred | n/a |
| OpenShift API for Data Protection | redhat-user-workloads/art-images | Fix deferred | n/a |
| OpenShift Developer Tools and Services | helm | Fix deferred | n/a |
| OpenShift Lightspeed | redhat-user-workloads/openshift-mcp-server | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines-client | Fix deferred | n/a |
| OpenShift Serverless | kn-workflow-plugin | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-clients | Fix deferred | n/a |
| OpenShift Serverless | redhat-user-workloads/kn-plugin-event-sender | Fix deferred | n/a |
| OpenShift Service Mesh 2 | openshift-golang-builder-container | Fix deferred | n/a |
| OpenShift Service Mesh 2 | redhat-user-workloads/kiali-2-6 | Fix deferred | n/a |
| OpenShift Service Mesh 3 | openshift-golang-builder-container | Fix deferred | n/a |
| OpenShift Service Mesh 3 | redhat-user-workloads/kiali-3-0 | Fix deferred | n/a |
| OpenShift Service Mesh 3 | redhat-user-workloads/kiali-3-1 | Fix deferred | n/a |
| OpenShift Service Mesh 3 | redhat-user-workloads/kiali-3-2 | Fix deferred | n/a |
| OpenShift Service Mesh 3 | redhat-user-workloads/kiali-3-3 | Fix deferred | n/a |
| Power monitoring for Red Hat OpenShift | redhat-user-workloads/kepler | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/3scale-rhel7-operator | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/3scale-rhel9-operator | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | redhat-user-workloads/volsync-0-13 | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | redhat-user-workloads/volsync-0-14 | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | redhat-user-workloads/volsync-0-15 | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | rhacs-eng/release-main | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl30 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl32 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | receptor | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | redhat-user-workloads/receptor-rhel9 | Fix deferred | n/a |
| Red Hat Ceph Storage 5 | rhceph-ci/grafana | Fix deferred | n/a |
| Red Hat Ceph Storage 6 | rhceph-ci/grafana | Fix deferred | n/a |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | redhat-certification-preflight | Fix deferred | n/a |
| Red Hat Connectivity Link 1 | redhat-user-workloads/rhcl-1-3-coredns | Fix deferred | n/a |
| Red Hat Developer Hub | rhdh/rhdh-rhel9-operator | Fix deferred | n/a |
| Red Hat Edge Manager 1 | flightctl | Fix deferred | n/a |
| Red Hat Edge Manager 1 | redhat-user-workloads/flightctl-api | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | buildah | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | delve | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | go-fdo-client | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | go-fdo-server | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | golang | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | grafana | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | grafana-pcp | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | gvisor-tap-vsock | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | ignition | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | image-builder | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | opentelemetry-collector | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | osbuild-composer | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | podman | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | skopeo | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | toolbox | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | trustee | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | trustee-guest-components | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | rhc | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | rhc-worker-script | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/buildah | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/conmon | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/containernetworking-plugins | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/podman | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/skopeo | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/toolbox | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | go-toolset:rhel8/go-toolset | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | go-toolset:rhel8/golang | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | grafana | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | grafana-pcp | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | osbuild-composer | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | rhc | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | buildah | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | conmon | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | containernetworking-plugins | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | go-toolset | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | grafana | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | grafana-pcp | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | gvisor-tap-vsock | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | ignition | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | image-builder | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | opentelemetry-collector | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | osbuild-composer | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | podman | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | rhc | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | skopeo | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | toolbox | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | trustee-guest-components | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | golang | Fix deferred | n/a |
| Red Hat JBoss Web Server 6 | jboss-webserver/jws-rhel9-operator | Fix deferred | n/a |
| Red Hat Lightspeed for Runtimes Operator | redhat-user-workloads/runtimes-inventory-operator | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-rhel8-operator | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-rhel9-operator | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-trainer-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Cluster Manager CLI | redhat-user-workloads/ocm-cli | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | conmon | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | containernetworking-plugins | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | cri-o | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | cri-tools | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | ignition | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | kata-containers | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | microshift | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift-clients | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift-golang-builder-container | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/frr-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-node | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sdn-rhel7 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sdn-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sdn-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | ose-aws-ecr-image-credential-provider | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | ose-azure-acr-image-credential-provider | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | ose-gcp-gcr-image-credential-provider | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | podman | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | redhat-user-workloads/art-images | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | skopeo | Fix deferred | n/a |
| Red Hat OpenShift Dev Spaces | redhat-user-workloads/udi-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Dev Workspaces Operator | redhat-user-workloads/devworkspace-rhel9-operator | Fix deferred | n/a |
| Red Hat OpenShift GitOps | redhat-user-workloads/dex-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift GitOps | redhat-user-workloads/dex-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | cnv-tech-preview/virt-api | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/virt-api | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/virt-api-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | kubevirt | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | openshift-golang-builder-container | Fix deferred | n/a |
| Red Hat OpenShift distributed tracing 3 | redhat-user-workloads/tempo | Fix deferred | n/a |
| Red Hat OpenShift for Windows Containers | redhat-user-workloads/windows-machine-config-operator-release-4-18 | Fix deferred | n/a |
| Red Hat OpenShift for Windows Containers | redhat-user-workloads/windows-machine-config-operator-release-4-19 | Fix deferred | n/a |
| Red Hat OpenShift for Windows Containers | redhat-user-workloads/windows-machine-config-operator-release-4-20 | Fix deferred | n/a |
| Red Hat OpenShift for Windows Containers | redhat-user-workloads/windows-machine-config-operator-release-4-21 | Fix deferred | n/a |
| Red Hat OpenShift on AWS | rosa | Fix deferred | n/a |
| Red Hat OpenStack Platform 16.2 | etcd | Fix deferred | n/a |
| Red Hat OpenStack Platform 16.2 | redhat-user-workloads/osp-director-agent | Fix deferred | n/a |
| Red Hat OpenStack Platform 17.1 | etcd | Fix deferred | n/a |
| Red Hat OpenStack Platform 17.1 | redhat-user-workloads/osp-director-agent | Fix deferred | n/a |
| Red Hat OpenStack Platform 18.0 | golang-github-openstack-k8s-operators-os-diff | Fix deferred | n/a |
| Red Hat OpenStack Platform 18.0 | redhat-user-workloads/ovn-operator | Fix deferred | n/a |
| Red Hat Openshift Data Foundation 4 | ocs4/cephcsi-rhel8 | Fix deferred | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/cephcsi-rhel8 | Fix deferred | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/cephcsi-rhel9 | Fix deferred | n/a |
| Red Hat Openshift Data Foundation 4 | rhceph-dev/odf4-cephcsi-rhel9 | Fix deferred | n/a |
| Red Hat Quay 3 | redhat-user-workloads/quay-quay-v3-10 | Fix deferred | n/a |
| Red Hat Quay 3 | redhat-user-workloads/quay-quay-v3-12 | Fix deferred | n/a |
| Red Hat Quay 3 | redhat-user-workloads/quay-quay-v3-13 | Fix deferred | n/a |
| Red Hat Quay 3 | redhat-user-workloads/quay-quay-v3-14 | Fix deferred | n/a |
| Red Hat Quay 3 | redhat-user-workloads/quay-quay-v3-15 | Fix deferred | n/a |
| Red Hat Quay 3 | redhat-user-workloads/quay-quay-v3-16 | Fix deferred | n/a |
| Red Hat Quay 3 | redhat-user-workloads/quay-quay-v3-17 | Fix deferred | n/a |
| Red Hat Quay 3 | redhat-user-workloads/quay-quay-v3-9 | Fix deferred | n/a |
| Red Hat Satellite 6 | redhat-user-workloads/iop-ingress-sat-6-18 | Fix deferred | n/a |
| Red Hat Satellite 6 | satellite:el8/yggdrasil-worker-forwarder | Fix deferred | n/a |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | Fix deferred | n/a |
| Red Hat Service Interconnect 1 | skupper-cli | Fix deferred | n/a |
| Red Hat Service Interconnect 2 | skupper-cli | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | redhat-user-workloads/cli-v08 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | securesign/gitsign | Fix deferred | n/a |
| Security Profiles Operator | redhat-user-workloads/security-profiles-operator-release | Fix deferred | n/a |
| Zero Trust Workload Identity Manager | redhat-user-workloads/spiffe-csi-driver-0-2-8 | Fix deferred | n/a |
| Zero Trust Workload Identity Manager - Tech Preview | redhat-user-workloads/spiffe-spire-agent-1-12-4 | Fix deferred | n/a |
| cert-manager Operator for Red Hat OpenShift | redhat-user-workloads/jetstack-cert-manager-1-17 | Fix deferred | n/a |
| cert-manager Operator for Red Hat OpenShift | redhat-user-workloads/jetstack-cert-manager-1-18 | Fix deferred | n/a |
stdlib
Go
Introduced 1.26.0-0 Fixed 1.26.2stdlib
Go
Introduced 0 Fixed 1.25.9
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | stdlib | 1.26.0-0 | 1.26.2 |
| Go | stdlib | 0 | 1.25.9 |
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1 other source (Red Hat) ▾
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed Apr 13, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Apr–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.33% (0.00333) | 24.10th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.29% (0.00290) | 20.45th | v5 (v2026.06.15) |
| Apr 8, 2026 | 0.01% (0.00011) | 1.41th | v4 (v2025.03.14) |
References (8)
- https://access.redhat.com/security/cve/CVE-2026-32289 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2456334 Issue Tracking
- https://go.dev/cl/763762 Patch
- https://go.dev/issue/78331 Issue Tracking
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU Mailing ListRelease Notes
- https://nvd.nist.gov/vuln/detail/CVE-2026-32289
- https://pkg.go.dev/vuln/GO-2026-4865 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-32289
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-32289 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2456334 | Issue Tracking | |
| https://go.dev/cl/763762 | Patch | |
| https://go.dev/issue/78331 | Issue Tracking | |
| https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU | Mailing ListRelease Notes | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-32289 | ||
| https://pkg.go.dev/vuln/GO-2026-4865 | Vendor Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2026-32289 |
Change history (0)
No recorded changes yet.