RHSA-2026:33078HighCVSS 6.5

Red Hat Security Advisory: OpenShift Virtualization v4.16 Images

Published
June 29, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-35469 →

📋 Description

CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products27

  • Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:1d205dee5f1aaec4e126521ed812a1376f4cd5b0fd70a55f82dc43fcc1afa98b_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:44ea9bd018b945ac5af9e68d1c9b053fca263188a7ef540f6f66e8a5e00e7f6f_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:709ac2066d6be26de990b3793ffe9011ad35632c844671e8eb093726383cfb99_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:c2dba850d2f58b6b14a5ffef360b20d9c5580ee987d9e2c4b362a41231ed98e8_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:1db2c6725424ee6299a79d09db92bb5a75fb714902607faebf70b5bd7aec1587_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:2e6c3f33d95fcdd48158171331763f6b7ec8742afc262c7cbfbbc8e149b00068_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:b516a94060b85d8cc92bc6320f5c1484810d0538d66f5388238a441b697e3213_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:f5a053d3b4af874412ced8e639833bf95dbdd0812f694353571d32c4018baea1_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:08eae447cf27c403e1b494325a394d1c644ca5091b4b85162ad15f63d55bc63d_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:099a2886c168c9b77e55903fc48239f23495383b1486dc2df4ee32e6dd539cd0_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:a73b662fa3bac3501ab8a8e09171ae432f66eae7f14c99b756b4428b024647ce_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:e9509501f8975c93f79d64f98c84998d85228e5ee5ad7e754c984830fd7c29c5_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:b5541b5d2280ff1ff03069e06f46fe9d6d34cccd79675e2c94e7aaa8ffd745a0_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:d99be3b1b17b4bdca4c9304accce3f8fe3941ccb6f9c75a75d56d5c7b2e1af88_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:a3803f824b1d468240cce50e5be736ef0f69f78732774587dfb791c50cb78b2e_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:ff6be1cfaba152e86270ff622fafaad787f9ff2c5de74882751642c89d397820_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:12ce766a13cb011d26b4439bcf04a25fd5605e8c6959e6fbd2174bd41e8f51c8_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:4e1aae3ed9685991b5331fd3ec7d11f1074bb27970e0800d5c105f3259840fd3_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:45a671d09b8eeca4fd62e2d27ebaed2c5cc49bdb36363aebaf881b0afa0812b1_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:7eb14595f26d6fcdbdc55101477fc95bfacc5396291efd7db330802d7a1d3fd0_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:b818b96ad53d5913371dd136edc4337b99992d7cf96d12c8ba8042bc30167b9b_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:da2108fcfde25766ca8aa6751deca5fe2455f76e74c86b8860567052c5b52e44_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:9f8114fb6d660a93f8407cd407777ea85886eb0368302e70637c4a96a15426fa_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:d389a1df309cab868bbcb2340d02374454f927b0bd65317639e79dcd05b9dae7_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:3fb4981eb695e895237d26e70de07590d5f73f7d1a1ab57cf4661f82886ee007_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:4ebe6bfcca0eaa71024541fb5782e33c7434b30c86129237bfa477e21a2178cb_arm64 as a component of Red Hat Container Native Virtualization 4.16

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (4)