Red Hat OpenShift for Windows Containers vulnerabilities

6 known vulnerabilities in Red Hat OpenShift for Windows Containers from Red Hat. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  golang.org/x/crypto/ssh: Incorrect Authorization

  CVE-2026-46595May 22, 2026Golang.org/x/crypto

  Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

• 7.5 High severity

  golang.org/x/crypto/ssh: Improper Certificate Validation

  CVE-2026-39835May 22, 2026Golang.org/x/crypto

  SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

• 7.5 High severity

  golang.org/x/crypto/ssh: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-39830May 22, 2026Golang.org/x/crypto

  A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited globa

• 8.8 High severity

  golang.org/x/crypto/ssh: Improper Certificate Validation

  CVE-2026-39828May 22, 2026Golang.org/x/crypto

  When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil

• 7.5 High severity

  github.com/buger/jsonparser: Improper Validation of Array Index

  CVE-2026-32285Mar 26, 2026Github.com/buger/jsonparser

  The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

• 8.0 High severity

  Docker CLI: Uncontrolled Search Path Element

  CVE-2025-15558Mar 4, 2026Docker

  Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx