rhcos | Snyk

Direct Vulnerabilities

Known vulnerabilities in the rhcos package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Verification of Source of a Communication Channel	*
L Buffer Access with Incorrect Length Value	*
M Arbitrary Code Injection	*
M Improper Verification of Cryptographic Signature	*
M Arbitrary Code Injection	*
M Improper Verification of Cryptographic Signature	*
H Off-by-one Error	*
M Out-of-bounds Write	*
H Symlink Following	*
H Expired Pointer Dereference	*
M Directory Traversal	*
M Access of Resource Using Incompatible Type ('Type Confusion')	*
H Allocation of Resources Without Limits or Throttling	*
M Out-of-bounds Write	*
H Unchecked Input for Loop Condition	*
M Improper Null Termination	*
H Improper Update of Reference Count	*
M Allocation of Resources Without Limits or Throttling	*
M Misinterpretation of Input	*
H Expired Pointer Dereference	*
H Use After Free	*
L CVE-2026-15028	*
M Information Exposure	*
M Improperly Implemented Security Check for Standard	*
M Missing Initialization of Resource	*
M Directory Traversal	*
M Arbitrary Argument Injection	*
H Expired Pointer Dereference	*
M Improper Restriction of Excessive Authentication Attempts	*
M Improper Restriction of Excessive Authentication Attempts	*
M Directory Traversal	*
H Insecure Default Initialization of Resource	*
H Improper Certificate Validation	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
H Improper Verification of Cryptographic Signature	*
M Authentication Bypass	*
H CVE-2026-8925	*
M Reliance on Cookies without Validation and Integrity Checking	*
H Allocation of Resources Without Limits or Throttling	*
H Improperly Implemented Security Check for Standard	*
H Arbitrary Code Injection	*
L Buffer Access with Incorrect Length Value	*
M Out-of-bounds Read	*
M Incorrect Calculation of Buffer Size	*
M Information Exposure	*
M Out-of-bounds Read	*
M Out-of-bounds Write	*
H Arbitrary Code Injection	*
M Expired Pointer Dereference	*
L Buffer Overflow	*
H Use of Incorrect Operator	*
H Function Call with Incorrectly Specified Arguments	*
H Improper Neutralization	*
M Out-of-bounds Write	*
M Link Following	*
H Directory Traversal	*
M Out-of-bounds Read	*
M Link Following	*
M Time-of-check Time-of-use (TOCTOU)	*
H Link Following	*
M Uncontrolled Recursion	*
M Double Free	*
M Out-of-bounds Write	*
H Out-of-bounds Read	*
M Link Following	*
M Buffer Overflow	*
M Use After Free	*
M Incorrect Calculation of Buffer Size	*
H Insufficient Granularity of Access Control	*
M Allocation of Resources Without Limits or Throttling	*
M Integer Overflow or Wraparound	*
H Allocation of Resources Without Limits or Throttling	*
H Missing Required Cryptographic Step	*
M Use After Free	*
H Improper Update of Reference Count	*
H Excessive Platform Resource Consumption within a Loop	*
H Excessive Platform Resource Consumption within a Loop	*
M Double Free	*
M Heap-based Buffer Overflow	*
L Out-of-bounds Read	*
M Improper Restriction of Communication Channel to Intended Endpoints	*
L Out-of-bounds Write	*
H Premature Release of Resource During Expected Lifetime	*
H Execution with Unnecessary Privileges	*
H Integer Overflow or Wraparound	*
M Insufficient Granularity of Access Control	*
M Heap-based Buffer Overflow	*
M Out-of-bounds Write	*
L Expired Pointer Dereference	*
M Inclusion of Functionality from Untrusted Control Sphere	*
M OS Command Injection	*
M Integer Underflow	*
H Expired Pointer Dereference	*
L Integer Overflow or Wraparound	*
L Improper Verification of Cryptographic Signature	*
H OS Command Injection	*
M Generation of Weak Initialization Vector (IV)	*
L Improper Validation of Integrity Check Value	*
L Incorrect Calculation of Buffer Size	*
L Improper Certificate Validation	*
M Off-by-one Error	*
H Insufficient Granularity of Access Control	*
L Information Exposure	*
L Improper Verification of Cryptographic Signature	*
L Integer Overflow or Wraparound	*
M NULL Pointer Dereference	*
M Allocation of Resources Without Limits or Throttling	*
M Improper Handling of Length Parameter Inconsistency	*
L NULL Pointer Dereference	*
L NULL Pointer Dereference	*
H Incorrect Privilege Assignment	*
C Access of Resource Using Incompatible Type ('Type Confusion')	*
H CRLF Injection	*
H Write-what-where Condition	*
M Release of Invalid Pointer or Reference	*
M Improper Update of Reference Count	*
M OS Command Injection	*
L Information Exposure	*
L Expired Pointer Dereference	*
M Processor Optimization Removal or Modification of Security-critical Code	*
M Time-of-check Time-of-use (TOCTOU)	*
H Insufficient Verification of Data Authenticity	*
M Improper Handling of Insufficient Permissions or Privileges	*
H OS Command Injection	*
M OS Command Injection	*
H Improper Access Control	*
M Buffer Over-read	*
M Off-by-one Error	*
M Out-of-bounds Write	*
M Expired Pointer Dereference	*
M Acceptance of Extraneous Untrusted Data With Trusted Data	*
M Resource Exhaustion	*
M Improper Certificate Validation	*
M Improper Certificate Validation	*
M Allocation of Resources Without Limits or Throttling	*
M CVE-2026-32792	*
M Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Out-of-bounds Read	*
M Link Following	*
H Integer Overflow or Wraparound	*
M Authentication Bypass	*
H Time-of-check Time-of-use (TOCTOU)	*
M Integer Overflow or Wraparound	*
M Stack-based Buffer Overflow	*
M Off-by-one Error	*
M Heap-based Buffer Overflow	*
H Improper Validation of Specified Type of Input	*
M Time-of-check Time-of-use (TOCTOU)	*
M OS Command Injection	*
H Allocation of Resources Without Limits or Throttling	*
H Access of Uninitialized Pointer	*
H CVE-2026-42944	*
M Information Exposure	*
H Use After Free	*
M Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	*
M Improper Validation of Specified Type of Input	*
H Undefined Behavior for Input to API	*
M Improper Input Validation	*
M Improper Neutralization of Null Byte or NUL Character	*
M Uncontrolled Recursion	*
M Uncontrolled Recursion	*
M Uncontrolled Recursion	*
M Integer Overflow or Wraparound	*
M Improper Input Validation	*
H Heap-based Buffer Overflow	*
H Out-of-bounds Read	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Incorrect Calculation of Buffer Size	*
M Integer Overflow or Wraparound	*
M Improper Certificate Validation	*
H Write-what-where Condition	*
H Improper Null Termination	*
M Buffer Overflow	*
H Improper Handling of Length Parameter Inconsistency	*
M Information Exposure	*
L Origin Validation Error	*
M Exposure of Data Element to Wrong Session	*
M Comparison Using Wrong Factors	*
M Information Exposure	*
L Incorrect Behavior Order: Early Validation	*
H Integer Underflow	*
M Improper Handling of Case Sensitivity	*
M Cleartext Transmission of Sensitive Information	*
H Improper Validation of Consistency within Input	*
M Buffer Overflow	*
L Out-of-bounds Read	*
M OS Command Injection	*
M NULL Pointer Dereference	*
L Out-of-bounds Write	*
H Deserialization of Untrusted Data	*
M Integer Underflow	*
M XML External Entity (XXE) Injection	*
M Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	*
M Incorrect Calculation of Buffer Size	*
M Access of Resource Using Incompatible Type ('Type Confusion')	*
M Uncontrolled Recursion	*
M Out-of-bounds Read	*
M Use of Externally-Controlled Format String	*
L Incorrect Permission Assignment for Critical Resource	*
H Heap-based Buffer Overflow	*
M Incorrect Calculation of Buffer Size	*
M NULL Pointer Dereference	*
M Resource Exhaustion	*
H Buffer Access with Incorrect Length Value	*
M Buffer Access with Incorrect Length Value	*
M Uncontrolled Recursion	*
H Predictable from Observable State	*
M Improper Validation of Specified Type of Input	*
L Improper Null Termination	*
H Out-of-bounds Read	*
M Integer Overflow or Wraparound	*
M Execution with Unnecessary Privileges	*
L Integer Overflow or Wraparound	*
M Arbitrary Argument Injection	*
M Expired Pointer Dereference	*
H Time-of-check Time-of-use (TOCTOU)	*
L NULL Pointer Dereference	*
L Improper Handling of Missing Special Element	*
L CVE-2026-28387	*
M Buffer Access with Incorrect Length Value	*
M OS Command Injection	*
M Expired Pointer Dereference	*
M NULL Pointer Dereference	*
M Integer Underflow	*
M Access of Uninitialized Pointer	*
L Authentication Bypass by Primary Weakness	*
L Improperly Implemented Security Check for Standard	*
L Improper Certificate Validation	*
M Improper Certificate Validation	*
L Information Exposure	*
M Improper Validation of Consistency within Input	*
M Directory Traversal	*
M Time-of-check Time-of-use (TOCTOU)	*
H OS Command Injection	*
H Least Privilege Violation	*
L OS Command Injection	*
H Improper Preservation of Permissions	*
M Improper Handling of Inconsistent Special Elements	*
M Incorrect Calculation of Buffer Size	*
M Buffer Overflow	*
M Directory Traversal	*
L Missing Authentication for Critical Function	*
L Misinterpretation of Input	*
M Improper Handling of Case Sensitivity	*
M External Control of File Name or Path	*
M OS Command Injection	*
M Reachable Assertion	*
M Integer Overflow or Wraparound	*
M Allocation of Resources Without Limits or Throttling	*
M Misinterpretation of Input	*
M Incorrect Execution-Assigned Permissions	*
M Expired Pointer Dereference	*
H Allocation of Resources Without Limits or Throttling	*
H OS Command Injection	*
M Improper Validation of Specified Type of Input	*
M Out-of-bounds Read	*
L Inappropriate Encoding for Output Context	*
M Improper Validation of Syntactic Correctness of Input	*
M Link Following	*
H Out-of-bounds Read	*
M Incorrect Bitwise Shift of Integer	*
H Reachable Assertion	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Improper Access Control	*
H Access of Uninitialized Pointer	*
L Use of Uninitialized Resource	*
M Expired Pointer Dereference	*
M Authentication Bypass by Primary Weakness	*
L Out-of-bounds Read	*
M Out-of-bounds Read	*
M Buffer Underflow	*
L Incorrect Calculation of Multi-Byte String Length	*
M Incorrect Implementation of Authentication Algorithm	*
M Improper Validation of Specified Type of Input	*
M OS Command Injection	*
M Buffer Underflow	*
L NULL Pointer Dereference	*
M Information Exposure	*
L Inefficient Regular Expression Complexity	*
M Buffer Overflow	*
M Buffer Overflow	*
M Integer Overflow or Wraparound	*
M Directory Traversal	*
M Out-of-bounds Read	*
L NULL Pointer Dereference	*
L Improper Validation of Specified Index, Position, or Offset in Input	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Unchecked Input for Loop Condition	*
M CVE-2026-23865	*
L Stack-based Buffer Overflow	*
L External Control of File Name or Path	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Unchecked Input for Loop Condition	*
L Reachable Assertion	*
M Out-of-bounds Read	*
H Out-of-bounds Read	*
L Access of Uninitialized Pointer	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Double Free	*
M Algorithmic Complexity	*
M Incorrect Execution-Assigned Permissions	*
M Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	*
M Buffer Overflow	*
M Memory Leak	*
M Memory Leak	*
M Buffer Overflow	*
H Link Following	*
M Uncontrolled Recursion	*
L Improper Validation of Specified Type of Input	*
L Out-of-bounds Write	*
L Access of Resource Using Incompatible Type ('Type Confusion')	*
L NULL Pointer Dereference	*
L Missing Required Cryptographic Step	*
H Buffer Overflow	*
M Improper Handling of Parameters	*
L NULL Pointer Dereference	*
L Access of Resource Using Incompatible Type ('Type Confusion')	*
M Incorrect Calculation of Buffer Size	*
L Improper Validation of Specified Quantity in Input	*
L Stack-based Buffer Overflow	*
H Improper Handling of Highly Compressed Data (Data Amplification)	*
H Allocation of Resources Without Limits or Throttling	*
H Improper Handling of Highly Compressed Data (Data Amplification)	*
L Use of Uninitialized Resource	*
M Time-of-check Time-of-use (TOCTOU)	*
M Uncontrolled Recursion	*
L Uncontrolled Recursion	*
L Resource Exhaustion	*
M Use of Uninitialized Resource	*
L Integer Overflow or Wraparound	*
M Out-of-bounds Read	*
M Reachable Assertion	*
M Reachable Assertion	*
M Reachable Assertion	*
M Out-of-bounds Read	*
M Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element	*
M Integer Underflow	*
L Buffer Overflow	*
M Resource Exhaustion	*
L Out-of-bounds Read	*
L Out-of-bounds Write	*
L Out-of-bounds Read	*
L Out-of-bounds Read	*
L NULL Pointer Dereference	*
L Stack-based Buffer Overflow	*
L Out-of-bounds Read	*
H Out-of-Bounds	*
M Information Exposure	*
M Use After Free	*
M Integer Overflow or Wraparound	*
H Improper Input Validation	*
H Resource Exhaustion	*
M Out-of-bounds Read	*
H Out-of-bounds Read	*
M Out-of-bounds Read	*
M Improper Use of Validation Framework	*
M Unrestricted Externally Accessible Lock	*
L Algorithmic Complexity	*
M Out-of-bounds Read	*
H Out-of-bounds Write	*
M Integer Overflow or Wraparound	*
M Incorrect Calculation of Buffer Size	*
M Expired Pointer Dereference	*
M CVE-2025-61662	*
M Expired Pointer Dereference	*
M Expired Pointer Dereference	*
M Expired Pointer Dereference	*
M NULL Pointer Dereference	*
M Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Resource Exhaustion	*
M Stack-based Buffer Overflow	*
H Resource Exhaustion	*
M Acceptance of Extraneous Untrusted Data With Trusted Data	*
H Improper Verification of Cryptographic Signature	*
H Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	*
M Improper Check for Unusual or Exceptional Conditions	*
L Unchecked Return Value	*
L Out-of-bounds Read	*
M Improper Validation of Specified Quantity in Input	*
L Use of Uninitialized Resource	*
L Access of Resource Using Incompatible Type ('Type Confusion')	*
L Out-of-bounds Write	*
L Out-of-bounds Read	*
M Improper Neutralization of Null Byte or NUL Character	*
L Buffer Access with Incorrect Length Value	*
L Out-of-bounds Read	*
L Out-of-bounds Read	*
H Improper Privilege Management	*
M Failure to Sanitize Special Element	*
M Use After Free	*
M Out-of-bounds Write	*
L Out-of-bounds Read	*
M Information Exposure	*
M Out-of-bounds Write	*
M Out-of-bounds Read	*
M Expired Pointer Dereference	*
H Allocation of Resources Without Limits or Throttling	*
M Out-of-bounds Read	*
M NULL Pointer Dereference	*
H Improper Authentication	*
L Memory Leak	*
H Expired Pointer Dereference	*
M Unchecked Input for Loop Condition	*
H Out-of-bounds Read	*
M Buffer Overflow	*
L Reachable Assertion	*
M Integer Overflow or Wraparound	*
L External Control of System or Configuration Setting	*
M NULL Pointer Dereference	*
M Double Free	*
M Insufficiently Protected Credentials	*
H Acceptance of Extraneous Untrusted Data With Trusted Data	*
M Directory Traversal	*
H Numeric Truncation Error	*
M Directory Traversal	*
M Directory Traversal	*
L Arbitrary Argument Injection	*
M Out-of-bounds Write	*
M Out-of-bounds Write	*
M Double Free	*
M NULL Pointer Dereference	*
M Improper Certificate Validation	*
H Use After Free	*
M OS Command Injection	*
M Heap-based Buffer Overflow	*
H Arbitrary Argument Injection	*
H CRLF Injection	*
M Buffer Overflow	*
M Return of Wrong Status Code	*
M Incorrect Calculation	*
L Use After Free	*
M Double Free	*
H Incorrect Authorization	*
M Out-of-bounds Read	*
L Missing Release of Resource after Effective Lifetime	*
M Uncontrolled Recursion	*
L Stack-based Buffer Overflow	*
M Directory Traversal	*
M Out-of-bounds Write	*
L Out-of-bounds Write	*
L Out-of-bounds Read	*
L Integer Overflow or Wraparound	*
H Integer Overflow or Wraparound	*
L Heap-based Buffer Overflow	*
L Out-of-bounds Read	*
M Uncontrolled Search Path Element	*
M Race Condition	*
M Stack-based Buffer Overflow	*
M Out-of-Bounds	*
M Out-of-Bounds	*
M Buffer Overflow	*
M Buffer Over-read	*
M Integer Overflow or Wraparound	*
M Untrusted Search Path	*
M Out-of-bounds Write	*
M Incorrect Privilege Assignment	*
M Missing Authentication for Critical Function	*
M Integer Overflow or Wraparound	*
M Out-of-bounds Read	*
M Reversible One-Way Hash	*
M Expected Behavior Violation	*
M Out-of-bounds Read	*
M Return of Wrong Status Code	*
L Missing Release of Resource after Effective Lifetime	*
H NULL Pointer Dereference	*
M Arbitrary Argument Injection	*
M Uncontrolled Recursion	*
H Out-of-bounds Write	*
H Use After Free	*
H Use After Free	*
H Buffer Overflow	*
M Use of Uninitialized Resource	*
M Information Exposure	*
M Unchecked Return Value	*
L NULL Pointer Dereference	*
H Directory Traversal	*
L Use After Free	*
M Out-of-bounds Write	*
M Out-of-bounds Write	*
M Improper Update of Reference Count	*
H Stack-based Buffer Overflow	*
M Unchecked Return Value	*
M Out-of-bounds Write	*
M Out-of-bounds Write	*
H Use After Free	*
M Out-of-bounds Write	*
M Out-of-bounds Write	*
L NULL Pointer Dereference	*
M Trust Boundary Violation	*
M Use After Free	*
H Out-of-bounds Write	*
M Detection of Error Condition Without Action	*
L Out-of-Bounds	*
L Missing Release of Resource after Effective Lifetime	*
L Missing Release of Resource after Effective Lifetime	*
L Out-of-Bounds	*
L Missing Release of Resource after Effective Lifetime	*
H Out-of-bounds Write	*
M Algorithmic Complexity	*
M Algorithmic Complexity	*

Vulnerability

Vulnerable Version

Improper Verification of Source of a Communication Channel