RHSA-2026:27941HighCVSS 6.5

Red Hat Security Advisory: OpenShift Virtualization v4.22 Images

Published
June 22, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-35469 →

📋 Description

CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products49

  • Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/iommufd-device-plugin-rhel9@sha256:4baa16ba75b404b69d71f7cf30f1e3468643531c3b5bf52476d0209d94fa8540_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/iommufd-device-plugin-rhel9@sha256:7727fd7e7d796b11c0c6d43aad136cafb2eb58f76b724a3cabedb9b928408114_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/iommufd-device-plugin-rhel9@sha256:a4b3cc14792e7ca66f2bc090cfaf616a2cbb39039266990f1fc1e900b4f435ad_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:0762631b138a96bf055b945f6a5fac5c2063dc11013f0655ac62ec9bdd330057_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:2b57cf19a4a036d1c988378718c68d7f932b45a16020722ea19d0499596c3981_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:ccc6101666b40eb6647af714b8c98d851084f8821451d82641c43dc6fb4433d0_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:8705590ac5f7ee1056e511340e37a36e12c330a3f7c9a19803833f70de1b63d9_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:abad6a1780d9cdaa03b2ff772550a2216fd37c0dd19fe37b6178029d1d8ddfbf_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:e8aa12821b8b7b938a7f7d6c99f072bfbab84647457c1b0a90998c15e5780ac1_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:89e4032a85c85328a0668cca4c2ce58c5ef561df90c30f4a94ab905a5d481b93_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:903541d86809aec5dcf4c21a73c02ae573ecdd8d7e37a91399ccb58529018f61_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:bf838d9c0707b87464cd10be777b8374b7702dd96b873662f8b9ae2c54eb81bb_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:3bfe632172eb041339ca403af245487e1b1d9fda07fc5b6acd92c9c16afea053_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:6305600b55c18d1a96691e94ccf94c9922d71ace0245b1bb3c39a134dd452544_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:d91bc80998e9ce24cd69759bc25a601bb83f6a3c05212e7b0c5ddb1c64939285_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:0508640bb34d84a9da734e2a46f673c395df840c11834cb8cdb1df7bf47cf32f_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:4127b68ed8050e0bc36e7fd0f29b3c3fe968e0f686ee5197d9b6abf6eb9f9c7f_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:96394aa85fbd2d76f18ba7bfaf863cf7ae504da1919f174936afc86275372d94_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:44f2394436b9f87a7807d0d3474df731abe229661c1c6fc6eb68ff4a22d05c3c_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:67c8a29805ab9326f8efba46a5a58ba8b4998f3c8b8710fe647ced870bea26db_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:c39e25fc80cb1a9bfe552959504468a80b56ec05f7b69ea475558622814e7e7e_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:783c9943de56a592405df70eafaa9b25d43404dab865642f763c5e1b113bbc46_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:8ea21e7c15a944a6b886e720cc77f57756ca27b382b6160a37eea108c7a3a85a_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:8edc42c6cdf4fecedf16af3026ba1e13b7f698536a9d905e50fa13675c4c23c2_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:0d0e6ffd72a31907869fdeab2dd03bad5acdba7d56771a06a3225a412be86f04_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:606141828a80718feb413803076fe89d985899755c29e9a43104135a32fa3fbf_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:a12e14a88cb048aa4304c47e1f71ab728f1726180f0553c9d6884cf702c0bcb1_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:6ea04beeee4f902d66a0db9bb0e2bf7294d8ebf3618bfad434863415fff1df5b_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:7897c8a0bef63460693d3cfa7f6e7ded4f222f7b8655f5b1448c8122cc9699c9_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • +19 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (4)