RHSA-2026:17468HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.20.23 bug fix and security update

Published
May 20, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (13)

CVE-2025-61726 →CVE-2026-4800 →CVE-2026-22029 →CVE-2026-33186 →CVE-2026-34043 →CVE-2026-35469 →CVE-2026-42035 →CVE-2026-34986 →CVE-2026-40175 →CVE-2026-42033 →CVE-2026-42039 →CVE-2026-42041 →CVE-2026-42043 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-22029 — @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34043 — serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:b4faffcccfe50ecb0eab5908d36f7559cd8fd0c7bca8ee5d251861211c025cba_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:c4980ac2a3f12d809f901513ef0c0854b7738d63297afeab9042f52b21df0bae_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:e5338b53253ea4e21c067b7565f481536dcfd9d386b16aac2e7fe73680579ee9_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:f9648e251cf8de5ef93a9df54e73e5c143413e04325b8c23e9490e67f8883d78_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:1e2b0613956f5a7eb518188b5173a8f9d877a525ab7450dbbff0233783448bb0_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:649f491f0eed2b9abc9b34835e064f8b302cefb5acfcb96e262f06ba8e767d1a_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:c1cf8a7da4c3097b5c4a9cd61fba48ce77942080e3385f531480eb21a80b7e34_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:d7fe90827b240feb3da4da758938252fb4a317be745e2bbe825837cbeea4a6e3_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:751935603e396cab4693c610828eaab7878e2c539e424596c87ee8f05fc5c733_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:8fba8476a57886c253645e592dffe309f02c83c966f52f3234c68859b4c239f0_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:bd32ef94b91a63e5d5378c753937504fcd86e27c3c263eabc011485eb00c98e3_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:ecf6386a69be3df23a239ebda9c68c42dcb992d4c5ee522d99adcfddd16fa0c7_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:2007fc6d424e2075b80f2a987cd0ae65fd38ae02865aafddd4d5605aa3460474_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:67bbb3abf885004386bf727c6c2e26ccc92e14717ea79984e87ece4d5564259c_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:76e34864634f1c40b5de1c9e070e0114f08268891adfc337ea23baa332b68415_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:a7f39be712f91cea0bd467586dc1d4b572e8a6eeebfb245fc77841d9b6d39076_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:1c20d980d6c0ecbfbc54b11479c17fdef690fda3932494c2509fa26e8f2e8c92_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:24b6a6b7aa6170e7fb251a9f8638b4b9889ee94f387d5386f185d2cba2b263b0_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:33f278e1e4194d2cc4b8e35e8f69b3770dbdb268b2a7eab25e097e474501289a_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b83b05b5e8a51ddd39f381f111ad97cb6a5c5f46eb41f52abaa33222cad0bd0a_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:1e10432104c6d4fcfb1bf0a8da81d5543c8116cc84eb361d80e03191cde4642c_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:476c2df6b27e8c57e06d3f2888fc01c087d3d9051bc486f65217e337436a9768_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:4d8af49dbb3f2c2d6852e15cb4c4344e07fa36c479b2a3a82d2e16d20e9e2d18_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d77274cbe71ffb3b50f2cb8409b0b85fdec5904195d3b7f4bd2bbcacb508adb1_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:54b0df77a61552eb274868a80e9734e1b22523206c2bf83962209e5dc6d402ad_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:59afb33acea4f3eb31c9fd60ed52ec0a01b17ecb9ee8ccd4dcc982833b55d191_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:6ff9f86d3d93a6931519a131fcbb571b14e62b658bd0b36f11e2c9c2336d6530_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:df84b13853862c804aa3227e4d5d54cc1af1220496f8038f72f59244f9a91ff4_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:319fbe7ae6be5c2011097a9dc6111c614eebe68f3fd8666a0cd0774fb0f5d111_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:4a03c010c9c554dc86066a7130002cc8c0bdd13da6207a7eab299f1013690dbd (For s390x architecture) The image digest is sha256:b0c8a356ff222e9a2f76a81fedaa1c684d5242d274735a1a81317ba8c2cf0c52 (For ppc64le architecture) The image digest is sha256:c78236afd3fd806533da51d6dc016cca7b92f9e5e78d30a4ea3d5bc44667f5ad (For aarch64 architecture) The image digest is sha256:bf8d33c6ccdb2560cb61a4787aedecd645ade9e90c77be86c59653b9f06c474b All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (16)