DevWorkspace Operator 0.42 vulnerabilities

6 known vulnerabilities in DevWorkspace Operator 0.42 from Red Hat. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  net/http: Improper Validation of Unsafe Equivalence in Input

  CVE-2026-39821May 22, 2026Go standard libraryEPSS 1.83%

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege e

• 7.1 High severity

  golang.org/x/crypto/ssh: Incorrect Authorization

  CVE-2026-46595May 22, 2026Golang.org/x/crypto

  Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

• 7.4 High severity

  golang.org/x/crypto/ssh/knownhosts: Improper Certificate Validation

  CVE-2026-42508May 22, 2026Golang.org/x/cryptoEPSS 6.91%

  Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

• 7.5 High severity

  golang.org/x/crypto/ssh: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-39830May 22, 2026Golang.org/x/crypto

  A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited globa

• 7.5 High severity

  golang.org/x/crypto/ssh: Improper Verification of Cryptographic Signature

  CVE-2026-39829May 22, 2026Golang.org/x/crypto

  The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by u

• 8.8 High severity

  golang.org/x/crypto/ssh: Improper Certificate Validation

  CVE-2026-39828May 22, 2026Golang.org/x/crypto

  When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil