RHSA-2026:12279HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.15 security, enhancement & bug fix update

Published
April 30, 2026
Last Modified
July 31, 2026

🔗 CVE IDs covered (7)

CVE-2026-4800 →CVE-2026-33036 →CVE-2026-33186 →CVE-2026-34986 →CVE-2025-58183 →CVE-2025-61726 →CVE-2025-61729 →

📋 Description

CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-33036 — fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products92

  • Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:dd40accadd49771cd27b7f0de2c90a9b21e100a43369efe0393183cc434781cf_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:225ba1747733c974fd4a3c9b49f657b180b83486d1c35a473e8e5a2b96abcc53_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:8c6cbc8235011fce3c988e7fbeb908f8eeefc19fc44cad33595af89302c6f95c_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:93323b16517b9b7b24c952fa07207ff854738b8b290fa63db21ca79399c4ab2a_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:9707855db691fb72815baf3758cff648bda0b33a11b155f30ba04c950f776005_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:08d3d6db14a36f5338a958bc9ee5914f912f5980f20f8dc6775ad4cf1905aaaf_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:2b471f005eae461ce14a531275cdcb2ace42e90ff1615a5541181b79a657c34f_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:72054a55200a33d05d6c52ae2893edac550d1970cc4395e144f67715eed0f4a8_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:43490d8f164f31ea025772d00d3dca379d4b770c7aace1a9b4066d118701cbc0_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:5712877643261f69dc38438d0194e4fc299ad4efc98a89320b06066a605d5ed0_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:9f71b8ac38198f832d1687d6de10078f43c4fb189a25357a5a1f1148c1a467ab_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:05d8d117013db65743cfae129da519b604a87b4d91546116b13a6639d191d490_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:46ea3cd9a992d1bb984a247365f5a866640edf78cca9a853ed241118393bc7e1_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:51c2c549d33debec7c0b66b4c0b091bab1ea58559480e329759a1373b6d2dfd2_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:987982d5cbe11a564ae2bb6c38a4aae2ae351bdefa7e0280393ba2be011984fc_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:de4360c38bde7baf0095e8d6b4e98d382d0d746bf497577dc4221efa15b602d4_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:08aede339f0597f4327e8e72a4af707c960c7a41e2e78426163241dc33fb239e_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:0db0a9d4571af3dd647818bfa011d37e06ae721f3a7ba6306b1d5f47d740f17d_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:d26ac4eba416e06b01f72ddd90e7fc0148653d0ceedc67beefafafe522931957_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:fb585faf2e75939b157377bfa50eabf0f649492a5461ad79cb2e7c6fb35f700d_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:bc5267ef2a3e4fa2b6c8dd2043608399b307a292c6860ab99d750c478d409e0e_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:12cb5269ac62949e96efbdae61dc9551a5e1574177b6c9383879b6b290b99ced_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:22ff45bb3a0d0d11d3eb4c9255eacd2b5517925370374968bc5edf4012baf72b_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:824029e5f4fcd750292bac55cee15f17bd002a42e6d36c108122d50eeeaea776_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:9ff944fe6ba891448ed4558f33248d66250565c67fe45d4abc12964c1016a1f9_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:063d240d7ed66b531da1fdbc2e1978701c161b7fe90c6e5abf9d8064789d0f08_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:0a880a5bd07e0272a59254a92c1c98a15e076664e35f7f0d5f6e800102425898_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:69d362c35147c545d73437b7be9e9300a4812e6f30371782084da31f4c13b723_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:b7f9658075cdc1013d83a00e514372e1f5faa76e9bec9c431c636e0255c262ff_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • +62 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.19/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (11)