CVE-2026-27141: Golang Vulnerability in NetApp Products

Medium [CVE-2026-27141] Golang Vulnerability in NetApp Products

NTAP-20260320-0012Source published Mar 20, 2026Source updated Sep 3, 2026

Multiple NetApp products incorporate Golang. golang.org/x/net/http2 versions 0.50.0 prior to 0.51.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center - NetApp Kubernetes Monitoring Operator. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.

Affected products in this advisory

• Astra Control Center - NetApp Kubernetes Monitoring Operator

Source-reported affected versions

• 0.50.0
• 0.51.0

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• Astra Control Center - NetApp Kubernetes Monitoring Operator has no planned fix; migrate to a supported release or product and consult NetApp's end-of-support notice.

Medium [CVE-2026-27141] Denial of Service due to malformed HTTP/2 frames

CVE-2026-27141Source published Feb 26, 2026

Denial of Service due to malformed HTTP/2 frames. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-476. Affected package(s): openshift-pipelines/pipelines-operator-bundle:1781686494, openshift-pipelines/pipelines-rhel9-operator:1780645012, golang1. Resolved in Red Hat advisory RHSA-2026:7385 — update the affected packages (`sudo dnf update`).

Related products — impact not confirmed

• openshift-pipelines/pipelines-operator-bundle:1781686494
• openshift-pipelines/pipelines-rhel9-operator:1780645012
• golang1
• Red Hat Enterprise Linux

Source-reported affected versions

• openshift-pipelines/pipelines-operator-bundle:1781686494
• openshift-pipelines/pipelines-rhel9-operator:1780645012
• golang1-26-main-1.26.2-1.hum1
• golang1-25-main-1.25.9-1.hum1

Source-reported fixed versions

• RHSA-2026:7385

Mitigation guidance

• Update the affected package(s) to the fixed version shipped in RHSA-2026:7385 (`sudo dnf update` / `yum update`).

Critical [CVE-2025-61726 +30] Third-Party Package Updates in Splunk Enterprise - October 2026

SVD-2026-1009Source published Oct 21, 2026

This bulletin covers 31 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher. Affected products named by the advisory: Splunk Enterprise 10.4; Splunk Enterprise 10.2; Splunk Enterprise 10.0; Splunk Enterprise 9.4.

Affected products in this advisory

• Splunk Enterprise 10.4
• Splunk Enterprise 10.2
• Splunk Enterprise 10.0
• Splunk Enterprise 9.4

Source-reported affected versions

• Splunk Enterprise 10.4.0 to 10.4.3
• Splunk Enterprise 10.2.0 to 10.2.7
• Splunk Enterprise 10.0.0 to 10.0.10
• Splunk Enterprise 9.4.0 to 9.4.15

Source-reported fixed versions

• Splunk Enterprise 10.4.4
• Splunk Enterprise 10.2.8
• Splunk Enterprise 10.0.11
• Splunk Enterprise 9.4.16

Mitigation guidance

• Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.

Critical [CVE-2026-27141 +23] Third-Party Package Updates in Splunk Enterprise - September/October 2026

SVD-2026-1003Source published Oct 7, 2026

This bulletin covers 24 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 or higher. Affected products named by the advisory: Splunk Enterprise 10.4; Splunk Enterprise 10.2; Splunk Enterprise 10.0; Splunk Enterprise 9.4.

Affected products in this advisory

• Splunk Enterprise 10.4
• Splunk Enterprise 10.2
• Splunk Enterprise 10.0
• Splunk Enterprise 9.4

Source-reported affected versions

• Splunk Enterprise 10.4.0 to 10.4.2
• Splunk Enterprise 10.2.0 to 10.2.6
• Splunk Enterprise 10.0.0 to 10.0.9
• Splunk Enterprise 9.4.0 to 9.4.14

Source-reported fixed versions

• Splunk Enterprise 10.4.3
• Splunk Enterprise 10.2.7
• Splunk Enterprise 10.0.10
• Splunk Enterprise 9.4.15

Mitigation guidance

• Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 or higher.