RHSA-2026:12282HighCVSS 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.12.88 bug fix and security update

Published
May 6, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (8)

CVE-2025-22871 →CVE-2025-61726 →CVE-2025-61728 →CVE-2025-61731 →CVE-2025-61732 →CVE-2025-65637 →CVE-2025-68121 →CVE-2026-25679 →

📋 Description

CVE-2025-22871 — net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61731 — cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61732 — cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy CVE-2025-65637 — github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url

🎯 Affected products191

  • Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:cf03e567cdeea58957b2dec053a5bc460e98ea216a7435ea3a74ce3c714e89aa_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/driver-toolkit-rhel8@sha256:d6d93a43fe65063401165886c38eebed441c77639950e8d41e640cda98fe5f34_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:06ba21669739ac3ed8c99f2030ff9795ac12522b69712090a7ed2e64dbdcee73_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:b79dd721dc1e32a58ce8f487d812a83ef65093a9f5f4858b25b4884f1f3ddd2a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:0c3bcae29fc35ec43200062cdc2132a532fd05ea6ab852b94c078bd021106554_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:773a56f5a8af520068d3766809855d67a12bbe6fd026609e6dc2f31718ef3dad_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:425d8df19a8eb838ef991ac8418cbb4d8c4cc249b6a9bda1e0d2add88e5bc04c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:74a96c9dfd0379fc29339bc88a93dae06a7c1ed010c18392b0830ebab2163016_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:05d9f15364fa1002de4c51204e96736421f3545d5dfbb4321f24ec736fa3a9f4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8@sha256:ed796a9a1349a7060c15e741ea3320cbc5fa675d31820421c1afd13bdc4e8ffc_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel8@sha256:6900cca9b1cd0182f7224253cb5ef76ca4da72b232343afc7b16a2e39ed13abc_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:fd2ec1ce0840121d4d0b3ddf2c4e0bf871a81c0abd170c91560cd99a7a258951_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:814accc3a746b844d98da277d0b7fb1ab8dc39b3fb26b360f9859c0580f82b01_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:d0e083cd223ed9ccd3197a55d147b059b3513184416aea29e97b8d9f51d9b8fb_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-machine-controllers-rhel8@sha256:483c037a552300d4ba3315eb58435985cdd9c080ac3e546541e6b85cd00fee2e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel8@sha256:b60488bbd2311717b25d9453da25ea0c11cb4713a8b720e705366d7e6605d6a4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:bfb62f2e509aef2c0b54c4e921fb93a06728889472d3da0e49abad4bfe74c146_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:d52533e38e79d356dca7d25f9ebf45e7947f8e6685273d97f7a2817447e8607c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:0601dbbd1e2cb3a71e1403f03c703090a5f475231332dec50e0e7b860cb438b8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:971671c78883fdd40b5b05cfe443aad1e49c6ebd355b447cdcae227225e57021_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:bfbe33e8eaca9068f3648cefa734aebbf1ed2f6c8dc367b6f08a4d1ea7783026_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:49e1c4dc31db43df3a4a5e209f96ffa0f86f042682b920bf7a3c6f95a589867e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:3086d499c53038833f20f8020fe2f8de05dc5cdfb8afca6f03b0829cdd06e56a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:86f438d5c758999ec90abc4aeb7c42320675fbad4285bb9bb791d68814ae75df_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:e1b1c343912143a77344436c43b87a5fd02e2dde82d7d6df3db453aded7a6fad_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8@sha256:82b344bd36e258a5b56b9d30f57720ca72d4e358e20db60d383353b83d9655cc_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:2bb0769c88a09d33bf7c6c4e6de45fd534f512b6af5ff162728de084896ca9f7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8@sha256:d347b69f0352c978901f681fd408fa45843c330f4ba635107cf6d9bc4cbd4196_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel8@sha256:50082025328c61f371ca7f0a1f0f528c252f5ac589e6ea2c8fdc440df67237d1_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +161 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.

🔗 References (11)