rhcos | Snyk

Direct Vulnerabilities

Known vulnerabilities in the rhcos package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Verification of Cryptographic Signature	*
M Reliance on Cookies without Validation and Integrity Checking	*
H CVE-2026-8925	*
H Improper Certificate Validation	*
H Improperly Implemented Security Check for Standard	*
M Authentication Bypass	*
H Allocation of Resources Without Limits or Throttling	*
M Directory Traversal	*
H Insecure Default Initialization of Resource	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
H Arbitrary Code Injection	*
L Buffer Access with Incorrect Length Value	*
M Incorrect Calculation of Buffer Size	*
M Information Exposure	*
H Arbitrary Code Injection	*
M Out-of-bounds Read	*
M Out-of-bounds Read	*
M Out-of-bounds Write	*
L Buffer Overflow	*
M Expired Pointer Dereference	*
H Improper Control of Dynamically-Identified Variables	*
H Directory Traversal	*
M Link Following	*
H Improper Neutralization	*
H Out-of-bounds Read	*
H Link Following	*
M Buffer Overflow	*
M Time-of-check Time-of-use (TOCTOU)	*
M Link Following	*
M Out-of-bounds Read	*
M Out-of-bounds Write	*
M Out-of-bounds Write	*
M Link Following	*
H Use of Incorrect Operator	*
H Function Call with Incorrectly Specified Arguments	*
M Use After Free	*
M Double Free	*
M Uncontrolled Recursion	*
M Incorrect Calculation of Buffer Size	*
H Insufficient Granularity of Access Control	*
M Integer Overflow or Wraparound	*
M Allocation of Resources Without Limits or Throttling	*
H Allocation of Resources Without Limits or Throttling	*
M Use After Free	*
H Missing Required Cryptographic Step	*
H Excessive Platform Resource Consumption within a Loop	*
H Improper Update of Reference Count	*
M Improper Restriction of Communication Channel to Intended Endpoints	*
L Out-of-bounds Read	*
M Double Free	*
H Excessive Platform Resource Consumption within a Loop	*
M Heap-based Buffer Overflow	*
H Premature Release of Resource During Expected Lifetime	*
L Out-of-bounds Write	*
H Execution with Unnecessary Privileges	*
H Integer Overflow or Wraparound	*
M Insufficient Granularity of Access Control	*
M Out-of-bounds Write	*
M Heap-based Buffer Overflow	*
L Expired Pointer Dereference	*
M Inclusion of Functionality from Untrusted Control Sphere	*
M OS Command Injection	*
M Integer Underflow	*
H OS Command Injection	*
L Incorrect Calculation of Buffer Size	*
H Expired Pointer Dereference	*
L Improper Certificate Validation	*
L Improper Validation of Integrity Check Value	*
L Improper Verification of Cryptographic Signature	*
L Integer Overflow or Wraparound	*
L Integer Overflow or Wraparound	*
L Improper Verification of Cryptographic Signature	*
M Generation of Weak Initialization Vector (IV)	*
L NULL Pointer Dereference	*
L Information Exposure	*
M Allocation of Resources Without Limits or Throttling	*
M Improper Handling of Length Parameter Inconsistency	*
L NULL Pointer Dereference	*
M NULL Pointer Dereference	*
H Incorrect Privilege Assignment	*
H Write-what-where Condition	*
C Access of Resource Using Incompatible Type ('Type Confusion')	*
H CRLF Injection	*
H Untrusted Search Path	*
M Off-by-one Error	*
M Release of Invalid Pointer or Reference	*
M Improper Update of Reference Count	*
M OS Command Injection	*
L Expired Pointer Dereference	*
L Information Exposure	*
M Processor Optimization Removal or Modification of Security-critical Code	*
M Time-of-check Time-of-use (TOCTOU)	*
M OS Command Injection	*
H OS Command Injection	*
M Improper Handling of Insufficient Permissions or Privileges	*
H Insufficient Verification of Data Authenticity	*
H Improper Access Control	*
M Buffer Over-read	*
M Improper Certificate Validation	*
M Acceptance of Extraneous Untrusted Data With Trusted Data	*
M Resource Exhaustion	*
M Off-by-one Error	*
M Out-of-bounds Write	*
M Expired Pointer Dereference	*
M Improper Certificate Validation	*
M CVE-2026-32792	*
M Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Allocation of Resources Without Limits or Throttling	*
M Out-of-bounds Read	*
M Authentication Bypass	*
H Time-of-check Time-of-use (TOCTOU)	*
H Integer Overflow or Wraparound	*
M Link Following	*
M Integer Overflow or Wraparound	*
M Time-of-check Time-of-use (TOCTOU)	*
M Off-by-one Error	*
H Improper Validation of Specified Type of Input	*
M Stack-based Buffer Overflow	*
M Heap-based Buffer Overflow	*
M OS Command Injection	*
H Allocation of Resources Without Limits or Throttling	*
H Access of Uninitialized Pointer	*
H CVE-2026-42944	*
M Information Exposure	*
H Use After Free	*
M Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	*
M Improper Validation of Specified Type of Input	*
L Improper Privilege Management	*
H Undefined Behavior for Input to API	*
M Improper Input Validation	*
M Improper Neutralization of Null Byte or NUL Character	*
M Uncontrolled Recursion	*
M Integer Overflow or Wraparound	*
H Write-what-where Condition	*
M Uncontrolled Recursion	*
M Uncontrolled Recursion	*
M Improper Input Validation	*
H Out-of-bounds Read	*
H Heap-based Buffer Overflow	*
M Incorrect Calculation of Buffer Size	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Integer Overflow or Wraparound	*
H Write-what-where Condition	*
M Improper Certificate Validation	*
H Insufficient Granularity of Access Control	*
H Improper Null Termination	*
M Buffer Overflow	*
H Improper Handling of Length Parameter Inconsistency	*
M Cleartext Transmission of Sensitive Information	*
M Comparison Using Wrong Factors	*
M Information Exposure	*
H Integer Underflow	*
H Improper Validation of Consistency within Input	*
L Incorrect Behavior Order: Early Validation	*
M Exposure of Data Element to Wrong Session	*
M Improper Handling of Case Sensitivity	*
L Origin Validation Error	*
M Information Exposure	*
M Buffer Overflow	*
L Out-of-bounds Read	*
H Deserialization of Untrusted Data	*
L Out-of-bounds Write	*
M Integer Underflow	*
M XML External Entity (XXE) Injection	*
M OS Command Injection	*
M NULL Pointer Dereference	*
M Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	*
M Incorrect Calculation of Buffer Size	*
M Access of Resource Using Incompatible Type ('Type Confusion')	*
M Uncontrolled Recursion	*
M Use of Externally-Controlled Format String	*
L Incorrect Permission Assignment for Critical Resource	*
M Resource Exhaustion	*
M NULL Pointer Dereference	*
M Out-of-bounds Read	*
M Incorrect Calculation of Buffer Size	*
H Heap-based Buffer Overflow	*
H Buffer Access with Incorrect Length Value	*
M Buffer Access with Incorrect Length Value	*
H Out-of-bounds Read	*
H Predictable from Observable State	*
L Improper Null Termination	*
M Uncontrolled Recursion	*
M Improper Validation of Specified Type of Input	*
M Integer Overflow or Wraparound	*
M Execution with Unnecessary Privileges	*
L Integer Overflow or Wraparound	*
M Arbitrary Argument Injection	*
H Time-of-check Time-of-use (TOCTOU)	*
L NULL Pointer Dereference	*
M Expired Pointer Dereference	*
L Improper Handling of Missing Special Element	*
L CVE-2026-28387	*
M Buffer Access with Incorrect Length Value	*
M OS Command Injection	*
M Access of Uninitialized Pointer	*
M NULL Pointer Dereference	*
M Integer Underflow	*
M NULL Pointer Dereference	*
M Expired Pointer Dereference	*
L Authentication Bypass by Primary Weakness	*
L Improperly Implemented Security Check for Standard	*
L Improper Certificate Validation	*
L Information Exposure	*
M Improper Certificate Validation	*
H OS Command Injection	*
M Time-of-check Time-of-use (TOCTOU)	*
M Improper Validation of Consistency within Input	*
M Directory Traversal	*
L OS Command Injection	*
H Improper Preservation of Permissions	*
M Improper Handling of Inconsistent Special Elements	*
H Least Privilege Violation	*
M Improper Handling of Case Sensitivity	*
M External Control of File Name or Path	*
M OS Command Injection	*
L Missing Authentication for Critical Function	*
M Buffer Overflow	*
M Directory Traversal	*
L Misinterpretation of Input	*
M Incorrect Calculation of Buffer Size	*
M Reachable Assertion	*
M Integer Overflow or Wraparound	*
M Expired Pointer Dereference	*
M Misinterpretation of Input	*
M Incorrect Execution-Assigned Permissions	*
M Allocation of Resources Without Limits or Throttling	*
H Allocation of Resources Without Limits or Throttling	*
H OS Command Injection	*
M Improper Validation of Specified Type of Input	*
M Improper Validation of Syntactic Correctness of Input	*
L Inappropriate Encoding for Output Context	*
M Out-of-bounds Read	*
M Link Following	*
M Incorrect Bitwise Shift of Integer	*
H Reachable Assertion	*
H Out-of-bounds Read	*
M Improper Access Control	*
L Use of Uninitialized Resource	*
H Access of Uninitialized Pointer	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Stack-based Buffer Overflow	*
M Out-of-bounds Read	*
M Buffer Underflow	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
L External Control of File Name or Path	*
M Directory Traversal	*
M Algorithmic Complexity	*
M Out-of-bounds Read	*
M CVE-2026-23865	*
L NULL Pointer Dereference	*
M OS Command Injection	*
L Improper Validation of Specified Index, Position, or Offset in Input	*
L Double Free	*
L Unchecked Input for Loop Condition	*
M Incorrect Execution-Assigned Permissions	*
L Incorrect Calculation of Multi-Byte String Length	*
M Buffer Overflow	*
L Inefficient Regular Expression Complexity	*
M Information Exposure	*
M Authentication Bypass by Primary Weakness	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
H Out-of-bounds Read	*
M Buffer Underflow	*
L Unchecked Input for Loop Condition	*
M Incorrect Implementation of Authentication Algorithm	*
L NULL Pointer Dereference	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	*
M Buffer Overflow	*
M Expired Pointer Dereference	*
L Reachable Assertion	*
L Access of Uninitialized Pointer	*
M Out-of-bounds Read	*
L Out-of-bounds Read	*
M Buffer Overflow	*
M Memory Leak	*
M Memory Leak	*
M Improper Validation of Specified Type of Input	*
H Link Following	*
M Buffer Overflow	*
M Uncontrolled Recursion	*
L Improper Validation of Specified Quantity in Input	*
L NULL Pointer Dereference	*
L NULL Pointer Dereference	*
H Buffer Overflow	*
L Access of Resource Using Incompatible Type ('Type Confusion')	*
L Improper Validation of Specified Type of Input	*
L Missing Required Cryptographic Step	*
L Out-of-bounds Write	*
M Improper Handling of Parameters	*
M Incorrect Calculation of Buffer Size	*
L Access of Resource Using Incompatible Type ('Type Confusion')	*
L Stack-based Buffer Overflow	*
H Improper Handling of Highly Compressed Data (Data Amplification)	*
H Improper Handling of Highly Compressed Data (Data Amplification)	*
H Allocation of Resources Without Limits or Throttling	*
L Use of Uninitialized Resource	*
M Time-of-check Time-of-use (TOCTOU)	*
L Uncontrolled Recursion	*
M Uncontrolled Recursion	*
L Resource Exhaustion	*
M Use of Uninitialized Resource	*
L Integer Overflow or Wraparound	*
M Integer Underflow	*
M Out-of-bounds Read	*
L Buffer Overflow	*
M Reachable Assertion	*
M Out-of-bounds Read	*
M Reachable Assertion	*
M Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element	*
M Reachable Assertion	*
M Resource Exhaustion	*
L Out-of-bounds Read	*
L Out-of-bounds Read	*
M Integer Overflow or Wraparound	*
L Out-of-bounds Write	*
L Out-of-bounds Read	*
L Out-of-bounds Read	*
L Stack-based Buffer Overflow	*
L NULL Pointer Dereference	*
H Out-of-Bounds	*
M Information Exposure	*
M Use After Free	*
M Integer Overflow or Wraparound	*
H Improper Input Validation	*
H Resource Exhaustion	*
M Out-of-bounds Read	*
H Out-of-bounds Read	*
M Out-of-bounds Read	*
M Unrestricted Externally Accessible Lock	*
M Improper Use of Validation Framework	*
L Algorithmic Complexity	*
M Out-of-bounds Read	*
H Out-of-bounds Write	*
M Integer Overflow or Wraparound	*
M Expired Pointer Dereference	*
M Incorrect Calculation of Buffer Size	*
M Expired Pointer Dereference	*
M CVE-2025-61662	*
M Expired Pointer Dereference	*
M Expired Pointer Dereference	*
M NULL Pointer Dereference	*
M Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Resource Exhaustion	*
H Link Following	*
H Link Following	*
H Link Following	*
M Stack-based Buffer Overflow	*
H Resource Exhaustion	*
H Improper Verification of Cryptographic Signature	*
H Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	*
M Acceptance of Extraneous Untrusted Data With Trusted Data	*
L Out-of-bounds Read	*
L Unchecked Return Value	*
M Improper Validation of Specified Quantity in Input	*
L Use of Uninitialized Resource	*
L Access of Resource Using Incompatible Type ('Type Confusion')	*
H Improper Privilege Management	*
L Out-of-bounds Read	*
L Out-of-bounds Read	*
L Buffer Access with Incorrect Length Value	*
L Out-of-bounds Write	*
L Out-of-bounds Read	*
M Improper Neutralization of Null Byte or NUL Character	*
M Failure to Sanitize Special Element	*
M Use After Free	*
M Out-of-bounds Write	*
M Improper Check for Unusual or Exceptional Conditions	*
L Out-of-bounds Read	*
M Information Exposure	*
M Out-of-bounds Write	*
M Out-of-bounds Read	*
M Expired Pointer Dereference	*
M Creation of Temporary File With Insecure Permissions	*
H Allocation of Resources Without Limits or Throttling	*
M Out-of-bounds Read	*
H Improper Authentication	*
M NULL Pointer Dereference	*
L Memory Leak	*
H Directory Traversal	*
M Unchecked Input for Loop Condition	*
H Expired Pointer Dereference	*
H Out-of-bounds Read	*
L Reachable Assertion	*
M Buffer Overflow	*
M Integer Overflow or Wraparound	*
L External Control of System or Configuration Setting	*
M NULL Pointer Dereference	*
M Double Free	*
M Insufficiently Protected Credentials	*
H Acceptance of Extraneous Untrusted Data With Trusted Data	*
M Directory Traversal	*
H Numeric Truncation Error	*
M Directory Traversal	*
M Directory Traversal	*
L Arbitrary Argument Injection	*
M Out-of-bounds Write	*
M Out-of-bounds Write	*
H Use After Free	*
M Improper Certificate Validation	*
M Heap-based Buffer Overflow	*
M NULL Pointer Dereference	*
M Double Free	*
M OS Command Injection	*
M Buffer Overflow	*
H Arbitrary Argument Injection	*
H CRLF Injection	*
M Incorrect Calculation	*
M Return of Wrong Status Code	*
M Double Free	*
L Use After Free	*
H Incorrect Authorization	*
M Allocation of Resources Without Limits or Throttling	*
M Out-of-bounds Read	*
H Improper Certificate Validation	*
L Missing Release of Resource after Effective Lifetime	*
M Uncontrolled Recursion	*
L Stack-based Buffer Overflow	*
M Directory Traversal	*
M Out-of-bounds Write	*
L Integer Overflow or Wraparound	*
L Out-of-bounds Write	*
L Out-of-bounds Read	*
H Integer Overflow or Wraparound	*
L Heap-based Buffer Overflow	*
L Out-of-bounds Read	*
M Uncontrolled Search Path Element	*
M Race Condition	*
M Out-of-Bounds	*
M Stack-based Buffer Overflow	*
M Out-of-Bounds	*
M Buffer Overflow	*
M Buffer Over-read	*
M Integer Overflow or Wraparound	*
M Untrusted Search Path	*
M Out-of-bounds Write	*
M Incorrect Privilege Assignment	*
M Missing Authentication for Critical Function	*
M Integer Overflow or Wraparound	*
M Out-of-bounds Read	*
M Reversible One-Way Hash	*
M Expected Behavior Violation	*
M Out-of-bounds Read	*
M Return of Wrong Status Code	*
L Missing Release of Resource after Effective Lifetime	*
H NULL Pointer Dereference	*
H Use After Free	*
H Out-of-bounds Write	*
M Arbitrary Argument Injection	*
H Use After Free	*
M Uncontrolled Recursion	*
M Use of Uninitialized Resource	*
H Buffer Overflow	*
M Information Exposure	*
M Unchecked Return Value	*
L NULL Pointer Dereference	*
H Directory Traversal	*
M Out-of-bounds Write	*
L NULL Pointer Dereference	*
L Use After Free	*
M Out-of-bounds Write	*
M Use After Free	*
H Stack-based Buffer Overflow	*
H Use After Free	*
H Out-of-bounds Write	*
M Trust Boundary Violation	*
M Out-of-bounds Write	*
M Out-of-bounds Write	*
M Out-of-bounds Write	*
M Improper Update of Reference Count	*
M Out-of-bounds Write	*
M Unchecked Return Value	*
M Detection of Error Condition Without Action	*
L Out-of-Bounds	*
L Missing Release of Resource after Effective Lifetime	*
L Missing Release of Resource after Effective Lifetime	*
L Out-of-Bounds	*
L Missing Release of Resource after Effective Lifetime	*
M Algorithmic Complexity	*
M Algorithmic Complexity	*
H Out-of-bounds Write	*
M Out-of-bounds Write	*
H Resource Exhaustion	*
H Resource Exhaustion	*
M Directory Traversal	*
M Use After Free	*
M Incorrect Calculation of Buffer Size	*
L Out-of-bounds Write	*
L Improper Check for Unusual or Exceptional Conditions	*
H Improper Privilege Management	*
L Covert Timing Channel	*
M Inappropriate Encoding for Output Context	*
L Inappropriate Encoding for Output Context	*
M Race Condition	*
H Use of Uninitialized Resource	*
M Detection of Error Condition Without Action	*
M Directory Traversal	*
L Heap-based Buffer Overflow	*
L Improper Neutralization	*

Vulnerability

Vulnerable Version

Improper Verification of Cryptographic Signature