Skip to content

Product

redhat/container-native-virtualization/virt-api vulnerabilities

26 published CVES affecting redhat/container-native-virtualization/virt-api, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
26
Critical
2
High
12
Medium
11
Low
1
Unscored
0
CISA KEV
0

Latest redhat/container-native-virtualization/virt-api CVEs

Newest publication first · page 1 of 2

  6. CVE-2026-32281 Inefficient policy validation in crypto/x509

    Published
    HighCVSS 7.5 EPSS 0.36%

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root C...

  7. CVE-2026-32280 Unexpected work during chain building in crypto/x509

    Published
    HighCVSS 7.5 EPSS 0.63%

    During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls...

  11. CVE-2026-32289 JsBraceDepth Context Tracking Bugs (XSS) in html/template

    Published
    MediumCVSS 6.1 EPSS 0.30%

    Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect es...

  15. CVE-2026-27137 Incorrect enforcement of email constraints in crypto/x509

    Published
    HighCVSS 7.5 EPSS 0.66%

    When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

  17. CVE-2025-68121 Unexpected session resumption in crypto/tls

    Published
    CriticalCVSS 10.0 EPSS 0.90%

    During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and...

  19. CVE-2025-22873 Improper access to parent directory of root in os

    Published
    LowCVSS 3.8 EPSS 0.23%

    It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or f...

  20. CVE-2025-61726 Memory exhaustion in query parameter parsing in net/url

    Published
    HighCVSS 7.5 EPSS 2.3%

    The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a la...

  22. CVE-2025-65637 Logrus is vulnerable to DoS when using Entry.Writer()

    Published
    HighCVSS 7.5 EPSS 0.68% PoC

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.