Threats Tagged 'cve-2026-42506'

The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes.

Multiple security vulnerabilities affecting the cosign tool and related Go cryptography libraries have been identified and fixed. These include issues parsing HTML files, a memory-safety vulnerability, and multiple issues in golang.org/x/crypto/ssh. The vulnerabilities have been addressed in updated versions provided by SUSE and Red Hat. A patch is available to remediate these issues.

CVE-2026-42506 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It occurs when parsing arbitrary HTML and rendering it using the Render function produces an unexpected HTML tree. This improper neutralization of input during web page generation can allow XSS attacks in applications relying on this package for HTML sanitization. No official patch or remediation guidance is currently available. There are no known exploits in the wild at this time.

Submariner enables direct networking between pods and services on different Kubernetes clusters that are either on-premises or in the cloud. For more information about Submariner, see the Submariner open source community website at: https://submariner.io/. This advisory contains bug fixes and enhancements to the Submariner container images. Security fix(es): * quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux (CVE-2024-53259) * golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336) * crypto/internal/nistec: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866) * golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (CVE-2025-22868) * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)