RHSA-2026:26420HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update

Published
June 16, 2026
Last Modified
August 30, 2026

🔗 CVE IDs covered (7)

CVE-2025-58183 →CVE-2025-61726 →CVE-2025-61729 →CVE-2026-6321 →CVE-2026-22029 →CVE-2026-25128 →CVE-2026-33186 →

📋 Description

CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2026-6321 — fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies CVE-2026-22029 — @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects CVE-2026-25128 — fast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities Bug CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products82

  • Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:91088d98fb787c421767d43c917aba66f2fb7b5e1e4493f9e1b71776b91c6063_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:255ed925fd638caf248ca62723e4a77db96981a39d549a6bd0d415ca10a72354_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:c0103be1bffa6ea5eb14dbe4205cf263dd2287acda170dbcb1a0031cd9675114_arm64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:c0ec45fb9c604bcd8cb91d642073953f9c809ac30d497f00b34bc65656e87e7f_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:c1fa14ae91d65fc11c82b69a2f9541d21a745d44efd24c604e6a27d04957f68d_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:8b5095bbd2ef111017c383396a78c5e2011e6f1acc89f3e25cc5c513da3fa39d_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:bb0f2f7cc5d8b8f3891e84dd1edca994116f49e2c3d5846f3a27459b65350c81_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:f65e82acbbcfb3cb4a640956351fe05cae2ecf457bf6af6ea18201a8ee6147b4_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:d1fd81d29813df14d5f594ea1be3db86ac431a318c1705258ff77c03b0194b39_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:d9affb0ef99ebe62a9dd9419a2c63ffedd041b3767f60b9a7ae277da1e85142a_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:ee8b2fbccb80578ffc877b81b3d596a9f31ac858c4ad285bd31fe91c6358bc61_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:dedcfccdebb5c0a393d4a64d7a9af23f57dd54d2cf616da32f612a29d4ded84f_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:77162e7abaaecaa794c9854f1f4a1156525db5c53d5ae2552d0381011d4698ed_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:bdf017a7babddfc112476c895098a379daa882faa1b9f143338e4e2bdae73b94_arm64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:c7cc52b4278d0e11c2b59b5a0918181b5051ebbbf72778c06f187a53f50c0d3d_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:e011f249bc755bb4214fb489d18252d274948e308d58189fc58ddb0e6b033e85_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:ca1c46e5ba9e0ce052d7a1c0be6f891178ec67f305f1f2bcca98c0121ef91371_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:d2ee226f8955c3999718a52941b36b41ee9b0d9d9fceb61aac240bfc5f9f3901_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:f8299774ae3e8f77b4e3f08508054e2f34f57afe6e48d4c504531c6e9c905f11_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:b5a1106102a10bd7ac49b4f3237b7d351a0ac820c8f7769f0aeff414f184bc9e_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:3c0b4864ce9505ae78ef08cb2e8e2125a8d4550553df687782656683bffcfb6b_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:65b2fffafa34a4d08697e5262936920d8344bacabbc924256a9c7d4817864096_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:99835488a1b30b768ff4302835afb491c81587d5dbf4532376341d17204ea20a_arm64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:a1829d559de88f980816f31db2477ba0606f28efee783bc9093db4e542064f76_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:29f4a222472c130d69c777d059f864cb1e3af7af5217c1ecd39df3ff80993318_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:3789a6546488cc07e27834ad97ed8c0c68e0a0186025b6c6ba7041e63586ada3_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:bf27789a13be939d1a4dbe150c460777adf2e147eec3fa6894868f2a660294b1_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-operator-bundle@sha256:ef92f86e98e2892ae769dc65fedc87a155efe3e8ea4ec5cb32712d2450fa652f_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:1dd7e077f3e77c10ab0433016e710dbaa261b4a17374c8e1c8c690fe439e1dbd_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • +52 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.18/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (11)