Inconsistent interpretation of HTTP requests in Go programming language - CVE-2025-22871

Vulnerability identifier: #VU107019

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2025-22871

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests when handling chunked data in net/http. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Go programming language
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Development Tools Module
openSUSE Leap
openEuler
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Concert Software
IBM Observability with Instana
Netcool Operations Insight
IT Service Intelligence (ITSI)
IBM Maximo Application Suite
Submariner
Ansible Automation Platform
Traefik
Splunk Operator for Kubernetes Add-on
Red Hat Advanced Cluster Security for Kubernetes
watsonx Orchestrate Developer Edition
Guardium Data Security Center (GDSC)
Storage Ceph
IBM Business Automation Manager Open Editions
Maximo Application Suite - IoT Component
watsonx.data
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox
toolbox-tests
toolbox (Red Hat package)
udica
python3.11-galaxy-importer (Red Hat package)
gvisor-tap-vsock (Red Hat package)
golang-github-openprinting-ipp-usb (Red Hat package)
butane (Red Hat package)
python3.11-pulp-ansible (Red Hat package)
opentelemetry-collector (Red Hat package)
ansible-rulebook (Red Hat package)
slirp4netns (Red Hat package)
automation-eda-controller (Red Hat package)
runc
slirp4netns
oci-seccomp-bpf-hook
containernetworking-plugins (Red Hat package)
containernetworking-plugins
receptor (Red Hat package)
aardvark-dns
netavark
skopeo (Red Hat package)
fuse-overlayfs
crun
skopeo-tests
skopeo
golang (Red Hat package)
crun (Red Hat package)
golang-help
golang
golang-devel
go1.23-doc
go1.23
go1.23-race
go1.23-openssl
go1.23-openssl-debuginfo
go1.23-openssl-race
go1.23-openssl-doc
golang-tests
golang-src
golang-bin
golang-shared
golang-misc
golang-docs
delve
delve (Red Hat package)
go1.24
go1.24-race
go1.24-doc
go-toolset
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah
buildah-tests
buildah (Red Hat package)
containers-common
containers-common (Red Hat package)
conmon
conmon (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
automation-gateway-proxy (Red Hat package)
automation-gateway (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
automation-gateway-proxy-openssl32 (Red Hat package)
automation-gateway-proxy-openssl30 (Red Hat package)
git-lfs (Red Hat package)
ignition (Red Hat package)
container-selinux
container-selinux (Red Hat package)
grafana-pcp (Red Hat package)
python3.11-psycopg (Red Hat package)
python3.11-dynaconf (Red Hat package)
git-lfs
git-lfs-doc
kata-containers (Red Hat package)
python3-criu
crit
criu
criu-devel
criu-libs
python3.11-pulpcore (Red Hat package)
libslirp-devel
libslirp
libslirp (Red Hat package)
podman (Red Hat package)
automation-controller (Red Hat package)
python3-podman
podman-docker
podman
podman-tests
podman-remote
podman-plugins
podman-catatonit
podman-gvproxy
python3.11-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift4-aws-iso (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
grafana-pcp
rust-afterburn (Red Hat package)
grafana (Red Hat package)
grafana-selinux
grafana
python3.11-websockets (Red Hat package)
molecule (Red Hat package)
python3.11-ansible-compat (Red Hat package)
ansible-navigator (Red Hat package)
ansible-lint (Red Hat package)
ansible-dev-environment (Red Hat package)
ansible-creator (Red Hat package)
python3.11-pytest-ansible (Red Hat package)
python3.11-tox-ansible (Red Hat package)
ansible-dev-tools (Red Hat package)
osbuild-composer (Red Hat package)
weldr-client (Red Hat package)
weldr-client-tests
weldr-client
cockpit-podman
osbuild-composer-worker
osbuild-composer
osbuild-composer-core
python3.11-dispatcherd (Red Hat package)
Splunk Enterprise
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift API for Data Protection (OADP)
FileBrowser
Red Hat Ceph Storage

Install updates from vendor's website.

Go programming language - addressed in versions 1.23.8, 1.24.2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.1
IBM Concert Software - update to 2.0.0
IBM Observability with Instana - update to 1.0.302
watsonx Orchestrate Developer Edition - update to 1.13.0
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.2.2
Guardium Data Security Center (GDSC) - update to 3.7.2
IT Service Intelligence (ITSI) - update to 4.21.2
Red Hat OpenShift Container Platform - addressed in versions 4.12.78, 4.14.59, 4.15.55, 4.16.44, 4.16.45, 4.17.35, 4.17.37, 4.18.20, 4.18.21, 4.19.1, 4.19.3, 4.19.7, 4.19.11
Storage Ceph - update to 8.1z2
IBM Business Automation Manager Open Editions - update to 8.0.8
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
Splunk Enterprise - addressed in versions 9.2.12, 9.3.9, 9.3.10, 9.4.8, 9.4.9, 10.0.3, 10.0.4, 10.2.1
toolbox - update to 0.0.99.5-2.0.1
toolbox-tests - update to 0.0.99.5-2.0.1
toolbox (Red Hat package) - update to 0.0.99.5-3.rhaos4.18.el8
udica - update to 0.2.6-21
python3.11-galaxy-importer (Red Hat package) - addressed in versions 0.4.31-2.el8ap, 0.4.31-2.el9ap
gvisor-tap-vsock (Red Hat package) - addressed in versions 0.8.5-2.el9_6, 0.8.5-2.el10_0
golang-github-openprinting-ipp-usb (Red Hat package) - update to 0.9.27-3.el10_0
butane (Red Hat package) - addressed in versions 0.20.0-5.rhaos4.15.el8, 0.21.0-5.rhaos4.16.el8, 0.23.0-2.rhaos4.18.el8, 0.24.0-2.rhaos4.19.el8
Submariner - update to 0.20.1
python3.11-pulp-ansible (Red Hat package) - addressed in versions 0.25.1-1.el8ap, 0.25.1-1.el9ap
opentelemetry-collector (Red Hat package) - addressed in versions 0.127.0-1.el9_4, 0.127.0-1.el9_6, 0.127.0-1.el10_0
Red Hat OpenShift Serverless - update to 1
ansible-rulebook (Red Hat package) - addressed in versions 1.1.7-1.el8ap, 1.1.7-1.el9ap
slirp4netns (Red Hat package) - update to 1.1.8-3.rhaos4.18.el8
automation-eda-controller (Red Hat package) - addressed in versions 1.1.11-1.el8ap, 1.1.11-1.el9ap
runc - update to 1.1.12-6.0.1
slirp4netns - update to 1.2.3-1
oci-seccomp-bpf-hook - update to 1.2.10-1
containernetworking-plugins (Red Hat package) - addressed in versions 1.4.0-5.rhaos4.15.el8, 1.4.0-5.rhaos4.17.el8, 1.4.0-5.rhaos4.18.el8, 1.4.0-6.el9_4.1, 1.4.0-6.rhaos4.16.el8, 1.6.2-2.el9_6
containernetworking-plugins - update to 1.4.0-6.0.1
OpenShift API for Data Protection (OADP) - update to 1.4.5
receptor (Red Hat package) - addressed in versions 1.5.7-1.el8ap, 1.5.7-1.el9ap, 1.5.7-2.el8ap, 1.5.7-2.el9ap
aardvark-dns - update to 1.10.1-2.0.1
netavark - update to 1.10.3-1.0.1
skopeo (Red Hat package) - addressed in versions 1.11.3-6.rhaos4.15.el8, 1.11.3-7.rhaos4.15.el9, 1.14.5-2.el9_4.1, 1.14.5-4.rhaos4.16.el8, 1.14.5-4.rhaos4.16.el9, 1.16.1-1.rhaos4.18.el8, 1.16.1-2.rhaos4.17.el8, 1.16.1-2.rhaos4.17.el9, 1.16.1-2.rhaos4.18.el9, 1.18.1-2.el9_6, 1.18.1-2.el10_0, 1.18.1-2.rhaos4.19.el9
fuse-overlayfs - update to 1.13-1.0.1
crun - update to 1.14.3-2
skopeo-tests - update to 1.14.5-4.0.1
skopeo - update to 1.14.5-4.0.1
golang (Red Hat package) - addressed in versions 1.19.13-16.el9_2, 1.23.9-1.el9_6, 1.23.9-1.el10_0
crun (Red Hat package) - update to 1.20-4.rhaos4.18.el8
golang-help - update to 1.21.4-37
golang - update to 1.21.4-37
golang-devel - update to 1.21.4-37
golang - addressed in versions 1.23.8-1.fc40, 1.23.8-1.fc41
go1.23-doc - update to 1.23.8-150000.1.27.1
go1.23 - update to 1.23.8-150000.1.27.1
go1.23-race - update to 1.23.8-150000.1.27.1
go1.23-openssl - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.23-openssl-debuginfo - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.23-openssl-race - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.23-openssl-doc - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
golang-tests - addressed in versions 1.24.0-9, 1.24.4-1.0.2
golang-src - addressed in versions 1.24.0-9, 1.24.4-1.0.2
golang - addressed in versions 1.24.0-9, 1.24.4-1.0.2
golang-bin - addressed in versions 1.24.0-9, 1.24.4-1.0.2
golang-shared - update to 1.24.0-9
golang-misc - addressed in versions 1.24.0-9, 1.24.4-1.0.2
golang-docs - addressed in versions 1.24.0-9, 1.24.4-1.0.2
delve - update to 1.24.1-1.0.2
delve (Red Hat package) - update to 1.24.1-2.el10_0
go1.24 - update to 1.24.2-150000.1.17.1
go1.24-race - update to 1.24.2-150000.1.17.1
go1.24-doc - update to 1.24.2-150000.1.17.1
go-toolset - update to 1.24.4-1
cri-tools (Red Hat package) - addressed in versions 1.25.0-6.el8, 1.28.0-8.el8, 1.28.0-8.el9, 1.29.0-7.el8, 1.29.0-7.el9, 1.30.0-6.el8, 1.30.0-6.el9, 1.31.1-4.el8, 1.31.1-4.el9, 1.32.0-2.el9
cri-o (Red Hat package) - addressed in versions 1.25.5-31.rhaos4.12.git53dc492.el8, 1.28.11-12.rhaos4.15.git48c134e.el8, 1.28.11-12.rhaos4.15.git48c134e.el9, 1.29.13-9.rhaos4.16.git6cc30d2.el8, 1.29.13-9.rhaos4.16.git6cc30d2.el9, 1.29.13-10.rhaos4.16.git6bda4d5.el8, 1.29.13-10.rhaos4.16.git6bda4d5.el9, 1.30.14-3.rhaos4.17.git0a197ae.el8, 1.30.14-3.rhaos4.17.git0a197ae.el9, 1.31.10-2.rhaos4.18.gitce48a32.el8, 1.31.10-2.rhaos4.18.gitce48a32.el9, 1.31.10-4.rhaos4.18.git3a7cdab.el8, 1.31.10-4.rhaos4.18.git3a7cdab.el9, 1.32.5-3.rhaos4.19.git9607a04.el9, 1.32.6-2.rhaos4.19.git8e1af22.el9
buildah - update to 1.33.12-2
buildah-tests - update to 1.33.12-2
buildah (Red Hat package) - addressed in versions 1.33.12-2.el9_4.1, 1.33.12-2.rhaos4.19.el9, 1.39.4-2.el9_6, 1.39.4-2.el10_0
containers-common - update to 1-82.0.1
containers-common (Red Hat package) - update to 1-87.rhaos4.18.el8
conmon - update to 2.1.10-1
conmon (Red Hat package) - update to 2.1.12-1.rhaos4.18.el8
Ansible Automation Platform - addressed in versions 2.4, 2.5
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-13.el8ap, 2.4-13.el9ap, 2.5-15.el8ap, 2.5-15.el9ap
automation-gateway-proxy (Red Hat package) - update to 2.5.10-2.el8ap
automation-gateway (Red Hat package) - addressed in versions 2.5.20250702-1.el8ap, 2.5.20250702-1.el9ap
python3.11-django-ansible-base (Red Hat package) - addressed in versions 2.5.20250702-1.el8ap, 2.5.20250702-1.el9ap
automation-gateway-proxy-openssl32 (Red Hat package) - update to 2.6.6-2.el9ap
automation-gateway-proxy-openssl30 (Red Hat package) - update to 2.6.6-2.el9ap
Multicluster Engine for Kubernetes - update to 2.8.3
Traefik - addressed in versions 2.11.24, 3.3.6
git-lfs (Red Hat package) - addressed in versions 2.13.3-3.el8_6.4, 2.13.3-5.el9_0.4, 3.2.0-2.el8_8.4, 3.2.0-2.el9_2.3
ignition (Red Hat package) - addressed in versions 2.16.2-7.rhaos4.15.el9, 2.18.0-7.rhaos4.16.el9, 2.18.0-8.rhaos4.18.el9, 2.21.0-4.rhaos4.19.el9
FileBrowser - update to 2.45.2
container-selinux - update to 2.229.0-2
container-selinux (Red Hat package) - update to 2.235.0-2.rhaos4.18.el8
Splunk Operator for Kubernetes Add-on - update to 3.0.0
grafana-pcp (Red Hat package) - update to 3.0.2-2.el8_4
python3.11-psycopg (Red Hat package) - addressed in versions 3.2.7-1.el8ap, 3.2.7-1.el9ap
python3.11-dynaconf (Red Hat package) - addressed in versions 3.2.11-1.el8ap, 3.2.11-1.el9ap
git-lfs - update to 3.4.1-5.0.1
git-lfs-doc - update to 3.4.1-5.0.1
kata-containers (Red Hat package) - addressed in versions 3.13.0-2.rhaos4.20.el9, 3.17.0-2.rhaos4.16.el9, 3.17.0-2.rhaos4.18.el9
python3-criu - update to 3.18-5.0.1
crit - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
python3.11-pulpcore (Red Hat package) - addressed in versions 3.49.42-1.el8ap, 3.49.42-1.el9ap
libslirp-devel - update to 4.4.0-2
libslirp - update to 4.4.0-2
libslirp (Red Hat package) - update to 4.4.0-6.rhaos4.18.el8
podman (Red Hat package) - addressed in versions 4.4.1-34.rhaos4.15.el8, 4.4.1-34.rhaos4.15.el9, 4.9.4-15.rhaos4.16.el8, 4.9.4-17.rhaos4.16.el9, 5.2.2-1.rhaos4.18.el8, 5.2.2-8.rhaos4.17.el8, 5.2.2-8.rhaos4.17.el9, 5.2.2-10.rhaos4.18.el9, 5.4.0-5.rhaos4.19.el9, 5.4.0-10.el9_6, 5.4.0-10.el10_0
automation-controller (Red Hat package) - addressed in versions 4.5.24-1.el8ap, 4.5.24-1.el9ap, 4.6.16-1.el8ap, 4.6.16-1.el9ap
Red Hat Advanced Cluster Security for Kubernetes - update to 4.7.5
python3-podman - update to 4.9.0-3
podman-docker - update to 4.9.4-22.0.1
podman - update to 4.9.4-22.0.1
podman-tests - update to 4.9.4-22.0.1
podman-remote - update to 4.9.4-22.0.1
podman-plugins - update to 4.9.4-22.0.1
podman-catatonit - update to 4.9.4-22.0.1
podman-gvproxy - update to 4.9.4-22.0.1
python3.11-galaxy-ng (Red Hat package) - addressed in versions 4.10.5-1.el8ap, 4.10.5-1.el9ap
automation-hub (Red Hat package) - addressed in versions 4.10.5-1.el8ap, 4.10.5-1.el9ap
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202507041136.p0.g0d799a2.assembly.stream.el8, 4.15.0-202507041136.p0.g0d799a2.assembly.stream.el9, 4.16.0-202507050035.p0.ge5bac33.assembly.stream.el8, 4.16.0-202507050035.p0.ge5bac33.assembly.stream.el9, 4.17.0-202507011904.p0.g626ecd1.assembly.stream.el8, 4.17.0-202507011904.p0.g626ecd1.assembly.stream.el9, 4.18.0-202507011252.p0.g9c24d76.assembly.stream.el8, 4.18.0-202507011252.p0.g9c24d76.assembly.stream.el9, 4.19.0-202506111541.p0.g7109d6b.assembly.stream.el9
openshift-ansible (Red Hat package) - addressed in versions 4.15.0-202507041136.p0.g41f6580.assembly.stream.el8, 4.15.0-202507041136.p0.g41f6580.assembly.stream.el9, 4.16.0-202507050035.p0.g06f35b9.assembly.stream.el8, 4.16.0-202507050035.p0.g06f35b9.assembly.stream.el9, 4.17.0-202507011904.p0.gde5283f.assembly.stream.el8, 4.17.0-202507011904.p0.gde5283f.assembly.stream.el9, 4.18.0-202507011252.p0.g8c16b0b.assembly.stream.el8, 4.18.0-202507011252.p0.g8c16b0b.assembly.stream.el9, 4.19.0-202506111249.p0.g75653ac.assembly.stream.el8, 4.19.0-202506111249.p0.g75653ac.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.15.0-202507041136.p0.g8231637.assembly.stream.el8, 4.15.0-202507041136.p0.g8231637.assembly.stream.el9, 4.16.0-202507050035.p0.gee354f6.assembly.stream.el8, 4.16.0-202507050035.p0.gee354f6.assembly.stream.el9, 4.17.0-202507011904.p0.gf39295c.assembly.stream.el8, 4.17.0-202507011904.p0.gf39295c.assembly.stream.el9, 4.18.0-202507080904.p0.g4fcb2d0.assembly.stream.el8, 4.18.0-202507080904.p0.g4fcb2d0.assembly.stream.el9, 4.19.0-202506161807.p0.gfa1fd95.assembly.stream.el8, 4.19.0-202506161807.p0.gfa1fd95.assembly.stream.el9, 4.19.0-202506301438.p0.g298429b.assembly.stream.el8, 4.19.0-202506301438.p0.g298429b.assembly.stream.el9
openshift4-aws-iso (Red Hat package) - addressed in versions 4.15.0-202507041136.p0.gd2acdd5.assembly.stream.el8, 4.16.0-202507050035.p0.gd2acdd5.assembly.stream.el8, 4.17.0-202507011904.p0.gd2acdd5.assembly.stream.el8, 4.18.0-202507011252.p0.gd2acdd5.assembly.stream.el8, 4.19.0-202506111249.p0.gd2acdd5.assembly.stream.el8
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202507041136.p0.gfc50272.assembly.stream.el8, 4.15.0-202507041136.p0.gfc50272.assembly.stream.el9, 4.16.0-202507050035.p0.g26b43df.assembly.stream.el8, 4.16.0-202507050035.p0.g26b43df.assembly.stream.el9, 4.17.0-202507011904.p0.g8ce997d.assembly.stream.el8, 4.17.0-202507011904.p0.g8ce997d.assembly.stream.el9, 4.18.0-202507011252.p0.g6ea2356.assembly.stream.el8, 4.18.0-202507011252.p0.g6ea2356.assembly.stream.el9, 4.19.0-202506111541.p0.gd8d3aeb.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202507041136.p0.gfd77d92.assembly.stream.el8, 4.15.0-202507041136.p0.gfd77d92.assembly.stream.el9, 4.16.0-202507050035.p0.ga53e9de.assembly.stream.el8, 4.16.0-202507050035.p0.ga53e9de.assembly.stream.el9, 4.17.0-202507011904.p0.g144bace.assembly.stream.el8, 4.17.0-202507011904.p0.g144bace.assembly.stream.el9, 4.18.0-202507011252.p0.gc395190.assembly.stream.el8, 4.18.0-202507011252.p0.gc395190.assembly.stream.el9, 4.19.0-202506111541.p0.g425c1c5.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.15.0-202507141307.p0.gd4983da.assembly.stream.el8, 4.15.0-202507141307.p0.gd4983da.assembly.stream.el9, 4.16.0-202507092005.p0.ga6b193c.assembly.stream.el8, 4.16.0-202507092005.p0.ga6b193c.assembly.stream.el9, 4.17.0-202507011904.p0.ga5f4f89.assembly.stream.el8, 4.17.0-202507011904.p0.ga5f4f89.assembly.stream.el9, 4.18.0-202507051134.p0.g817e6dd.assembly.stream.el8, 4.18.0-202507051134.p0.g817e6dd.assembly.stream.el9, 4.19.0-202506161416.p0.ga36c41d.assembly.stream.el9, 4.19.0-202507010638.p0.g106d040.assembly.stream.el9
kernel (Red Hat package) - addressed in versions 4.18.0-372.151.1.el8_6, 5.14.0-284.126.1.el9_2, 5.14.0-427.76.1.el9_4, 5.14.0-427.79.1.el9_4, 5.14.0-570.23.1.el9_6, 5.14.0-570.25.1.el9_6
kernel-rt (Red Hat package) - addressed in versions 4.18.0-372.151.1.rt7.312.el8_6, 5.14.0-284.126.1.rt14.411.el9_2
grafana-pcp - update to 5.1.1-10
rust-afterburn (Red Hat package) - update to 5.3.0-2.rhaos4.12.el8
Red Hat Ceph Storage - addressed in versions 7.1, 8.1
grafana (Red Hat package) - addressed in versions 7.3.6-10.el8_4, 7.5.15-7.el8_8, 9.0.9-8.el9_2, 9.2.10-23.el9_4, 9.2.10-25.el8_10, 10.2.6-18.el10_0
Maximo Application Suite - IoT Component - addressed in versions 8.7.24, 8.8.20, 9.0.10, 9.1.1
grafana-selinux - update to 9.2.10-25.0.1
grafana - update to 9.2.10-25.0.1
python3.11-websockets (Red Hat package) - addressed in versions 15.0-2.el8ap, 15.0-2.el9ap
molecule (Red Hat package) - addressed in versions 25.5.0-1.el8ap, 25.5.0-1.el9ap
python3.11-ansible-compat (Red Hat package) - addressed in versions 25.5.0-1.el8ap, 25.5.0-1.el9ap
ansible-navigator (Red Hat package) - addressed in versions 25.5.0-1.el8ap, 25.5.0-1.el9ap
ansible-lint (Red Hat package) - addressed in versions 25.5.0-1.el8ap, 25.5.0-1.el9ap
ansible-dev-environment (Red Hat package) - addressed in versions 25.5.0-1.el8ap, 25.5.0-1.el9ap
ansible-creator (Red Hat package) - addressed in versions 25.5.0-1.el8ap, 25.5.0-1.el9ap
python3.11-pytest-ansible (Red Hat package) - addressed in versions 25.5.0-1.el8ap, 25.5.0-1.el9ap
python3.11-tox-ansible (Red Hat package) - addressed in versions 25.5.0-1.el8ap, 25.5.0-1.el9ap
ansible-dev-tools (Red Hat package) - addressed in versions 25.5.2-1.el8ap, 25.5.2-1.el9ap
osbuild-composer (Red Hat package) - addressed in versions 28.7-3.el8_4, 46.3-3.el8_6, 46.3-4.el9_0, 75-4.el8_8, 76.1-2.el9_2, 101.3-2.el9_4, 101-4.el8_10, 132.2-2.el9_6, 134.1-2.el10_0
weldr-client (Red Hat package) - addressed in versions 35.5-2.el8_6, 35.5-3.el9_0, 35.9-2.el9_2, 35.9-3.el8_8, 35.12-3.el8_10, 35.12-3.el9_4, 35.12-4.el9_6
weldr-client-tests - update to 35.12-3
weldr-client - update to 35.12-3
cockpit-podman - update to 84.1-1
osbuild-composer-worker - update to 132.2-2.0.1
osbuild-composer - update to 132.2-2.0.1
osbuild-composer-core - update to 132.2-2.0.1
python3.11-dispatcherd (Red Hat package) - addressed in versions 2025.5.19-2.el8ap, 2025.5.19-2.el9ap

• https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk/m/cs_6qIK5BAAJ
• https://github.com/golang/go/issues/71988

• HTTP request smuggling in Go net/http
• SUSE update for go1.23
• SUSE update for go1.24
• Fedora 41 update for golang
• Fedora 40 update for golang
• SUSE update for go1.23-openssl
• Red Hat Enterprise Linux 9 update for golang
• Red Hat Enterprise Linux 10 update for golang
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Red Hat Enterprise Linux 9 update for containernetworking-plugins
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 9 update for skopeo
• Red Hat Enterprise Linux 9 update for grafana
• Red Hat Enterprise Linux 10 update for grafana
• Red Hat Enterprise Linux 8 update for grafana
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Red Hat Enterprise Linux 9 update for grafana
• Red Hat Enterprise Linux 8 update for grafana
• Multiple vulnerabilities in Submariner 0.20
• Red Hat Enterprise Linux 9 update for golang
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 9 update for containernetworking-plugins
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 9 update for skopeo
• Red Hat Enterprise Linux 10 update for podman
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 10 update for buildah
• Red Hat Enterprise Linux 10 update for skopeo
• Red Hat Enterprise Linux 9 update for gvisor-tap-vsock
• Red Hat Enterprise Linux 10 update for gvisor-tap-vsock
• Red Hat Enterprise Linux 8 update for git-lfs
• Red Hat Enterprise Linux 8 update for git-lfs
• Red Hat Enterprise Linux 9 update for git-lfs
• Red Hat Enterprise Linux 8 update for grafana-pcp
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat Enterprise Linux 10 update for golang-github-openprinting-ipp-usb
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Red Hat Enterprise Linux 9 update for git-lfs
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 10 update for delve
• Inconsistent interpretation of HTTP requests in Red Hat OpenShift Container Platform 4.19 packages
• Red Hat Enterprise Linux 10 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for weldr-client
• Red Hat Enterprise Linux 9 update for weldr-client
• Red Hat Enterprise Linux 9 update for weldr-client
• Red Hat Enterprise Linux 9 update for weldr-client
• Red Hat Enterprise Linux 9 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for osbuild-composer
• Red Hat Enterprise Linux 8 update for osbuild-composer
• Red Hat Enterprise Linux 8 update for weldr-client
• Red Hat Enterprise Linux 8 update for osbuild-composer
• Red Hat Enterprise Linux 8 update for weldr-client
• Red Hat Enterprise Linux 8 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for opentelemetry-collector
• Red Hat Enterprise Linux 8 update for osbuild-composer
• Red Hat Enterprise Linux 8 update for weldr-client
• Inconsistent interpretation of HTTP requests in Ansible Automation Platform 2.4 packages
• Inconsistent interpretation of HTTP requests in Ansible Automation Platform 2.5 packages
• Inconsistent interpretation of HTTP requests in Red Hat OpenShift Container Platform 4.19 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17 packages
• Inconsistent interpretation of HTTP requests in Red Hat OpenShift Container Platform 4.12 packages
• Anolis OS update for container-tools:an8 module
• Anolis OS update for weldr-client
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Inconsistent interpretation of HTTP requests in Red Hat OpenShift Container Platform 4.18 packages
• Inconsistent interpretation of HTTP requests in Red Hat OpenShift Container Platform 4.16 packages
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.7
• Inconsistent interpretation of HTTP requests in Red Hat OpenShift Container Platform 4.15 packages
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Inconsistent interpretation of HTTP requests in Red Hat OpenShift Container Platform 4.16 packages
• Inconsistent interpretation of HTTP requests in Red Hat OpenShift Container Platform 4.18 packages
• Anolis OS update for grafana
• Anolis OS update for osbuild-composer
• Anolis OS update for grafana-pcp
• Anolis OS update for git-lfs
• Anolis OS update for go-toolset:an8 module
• Red Hat Enterprise Linux 9 update for opentelemetry-collector
• Red Hat Enterprise Linux 10 update for opentelemetry-collector
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Inconsistent interpretation of HTTP requests in Red Hat OpenShift Container Platform 4.19 packages
• SUSE update for go1.23-openssl
• Multiple vulnerabilities in IBM Observability with Instana
• openEuler 24.03 LTS SP2 update for golang
• openEuler 24.03 LTS SP1 update for golang
• openEuler 24.03 LTS update for golang
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.8
• Anolis OS update for golang
• Splunk Operator for Kubernetes Add-on update for third-party components
• IBM watsonx.data update for net/http package
• Multiple vulnerabilities in IBM Maximo Application Suite
• Red Hat OpenShift Container Platform 4.14 update for Go
• Multiple vulnerabilities in Netcool Operations Insight
• IBM watsonx Orchestrate Developer Edition update for net/http package
• IBM Storage Ceph update for net/http package
• Splunk Enterprise Security update for third-party components
• Multiple vulnerabilities in Splunk Enterprise
• HTTP Request smuggling in filebrowser
• Splunk IT Service Intelligence update for third-party components
• Traefik update for Go