RHSA-2026:25206HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.22.1 bug fix and security update

Published
June 16, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-34986 →

📋 Description

CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:79aefdd8bf2231691fed306b2dcb75ae6e755589230c1d0f51a6228ae2a8c1f0_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:7c6c412b21e44f96856624c9a2b677ea38e1251060a5d532e1e0e2620466dc76_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:87e7fd4f9da31527e80fae7aee2542078ef93c208143736cb0634a8f430b4b87_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:dc1744e797ede5c9b8dea9091d15a0232e04ff79ac8ed93f393fbcba3079a8ae_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:15523b885970866575d894d8ec8817369437a350e961f16bd243533537752233_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:40933be366439e7c6c821b65403b7075add844cd3b3a36e0ccec45d72f42f630_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:c385b21be12431d48ac92b8cbbc3cfcd9d230f7a3054ec6d52642e23271e20fb_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ca20660f84b2f730e1fe97e6a211485b3e98a7cfead5aad20b7ef375bbf8d886_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:7d9e5a0418ee4c04b3f8fc1e11c03801cb585148810628aef44f6291e43ca867_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:bd363479d35419b1a654db6beadcd32ea96d8992b041117935b14ddf84123981_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:d90ce8e754bc2eeaeb3c26ce3e29c2ec6507740d1d1d70438035da7f69473c07_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:dd368db0452e34a3309359761f40e4b384d0d41c0daecf1e1ac56b05a6fc2660_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:17f0c4b02fb96f82deae11d5803b7df877498da33cfcc711cc4aec8a90694580_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:63bb519bc51ca2f07975a8500f85561f14b0732aa722020ef8f0c7d6a7ebdcf5_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:86ead999b15a5fe947074d50a07ce1f91dd16d9de91b2e6984ea54739a0b2c32_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:c0e4074bdbfb23a8314140cf9a908d7d227d2978748a87937525538c7606721a_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:0c1c69cf14eaffd9c2cdbe1666fccd68d14a3545f92704a52a1673c5ca0d950d_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:16fd3fb4de77ca44f68d413df171cb52d3692f0a3116c357fbae57684282c18b_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:cb127223fe7eb4e9c2e5015f048243a4e574e98093747b332926f5d10b57647e_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:dd45b67edc23eadf61633663149e963ecf3e0666c70783f11877486b239250f8_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:a077595979d5128b6ba599d4cd2838db0379f6e3d87aff0626180489751486ea_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:ad4f40a3ce55d7b80ae866fc2768956c813a7cd263cf63345b3854064591ad7a_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:ca2e401de184d59c975264ef61223e50c0204741197defba71c43416b23f3184_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:d6ef48cd34d269d1509e09b5ea827104b76ae54257fd3ddf1334b19ee1d5a77b_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:0b4ea60a8acfeb1d368e80fbde39337907cc788b20d37360c12211d8797379ef_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:9c178fe5b6ed2097ee707cb175a03911b118dde3f4c31bc73d5a7e338854aba4_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:b14080f28e33ba82da7bb8ea2d71e3b77dbe1b6315c3283dfd58c3368c2e60ac_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:fe5225deb386ae5d49456b1044808d9661e304952cf93082cc804bca9d20792f_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:1d14299b5576a5383272944faade223ba2e0006d67b054274968a67f5e9e0821_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:a15674d407c156561629987807f6b3e827772c6d2ef51dd226a6114871f23844 (For s390x architecture) The image digest is sha256:15fe037fc5d8ae338a8eb12b1577454cd6ed5b85fbe17fd2554e02f474b965ca (For ppc64le architecture) The image digest is sha256:5abc76754299f26d72f19ad77078b96819890badc2015d66ddd48da909cd141f (For aarch64 architecture) The image digest is sha256:4bb7a44c5d17f11dd02851c91dc164dea4cc4d7026fd4be70ebdf19431a41ca7 All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (4)