RHSA-2026:3884HighCVSS 8.2

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.19.2 security update

Published
March 5, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (6)

CVE-2025-61728 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-21441 →CVE-2025-13465 →CVE-2025-61726 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

🎯 Affected products46

  • Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:138be82b54de000e765bee3b77ecedb271228e720d8195f4dd6adcf5ec4c50bc_arm64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:2e1362c72a0d6887a940a0bdf26b6bce9eb510064700e9f095c408abbd49c9bf_amd64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:5ffdb073886df729a401b3b11c192f6fa1cf300dc72735f59a7b087dbfbe64d1_s390x as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:a4b401970e2f2392983adf4e4fdc02b5219cd007f6fab853a5e77e65b504ff14_ppc64le as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:62df2a36dcf0e875d62882fd22ac10df0577e6edf1593c5a2cb425287ea747d1_arm64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:826d6f6528ded7c7d06bda756db80b65a85dccc845da6e9549f292e15bbe1e62_ppc64le as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:cac9de88e325bdcd774e47416349cd04d9485140ba2757789af7ece0bfdc5f10_amd64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:f992bca52fbfa76a67b07d3cf5a7921234dbf4765d77acddc3b53c7cd6c6af4e_s390x as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:86daebba4143bbc47fbe21fd201fd4724dd58a235e6880b872eabdc62d74323d_arm64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:92123645a6195209ae1159cc3366f7d937773aa47ce4b2d95e071994e7ad5326_amd64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:d193023a0943e711f3a4ac3fa541d2996c0e49f4fc3df380e0c3d203d9447d9c_s390x as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:ead132dfd8d85e9b2abfa332c6da9c7354b09eebcb2e3aa13f0376c6ac32562d_ppc64le as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:2c9c09665cdfe0d15496232eecb98d8a8a0ec415e31162113e022de9729653ab_amd64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:4c7f4f07f63ec65cea08d79a3216d1281ab4e30116e9eba68f6196680e90ff7b_ppc64le as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:733cd034e950192fc651610d5d8f0e3eb0d0e8cbb6d27efbec297446854b36c1_s390x as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8@sha256:d1e3f3cc9aae3466975e4d6e7699a5f098538df9f831492a9b49be2fec49b7a8_arm64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:78d1ebdf50b49e4acce49cf9de00e2a0f38efa00df5e44d359eaf7fedb13cab9_arm64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:7d86d3ca3e7973f9d03d938977fb5486c009a7a2f6a342ef806078ed04eb9946_s390x as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:d79ab12f0505b689e03a04952ddb4b8cb096a544742195443e17f040edc64778_ppc64le as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:e47bf6b1a868b557ae88ff0a284711ea5c9379bcc2bbefdcbd3ab501b4c3232d_amd64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:3fa5c0abd247240801d6b92d01579587472a219465c229f9d73c8a2245610a70_s390x as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:aeccbbcdb0f4311c3c2f1408f6e72fbfb73273138f3fddd7f3b678e71ee7f3e7_arm64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:c4efd2edea9a977c138a7af1fb2aa0363b9a880091332b6a0797028dd3afc3a8_ppc64le as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:ea4f3f8e721945a2ca03156e50b1b76aabf2ebef72fb9db57eebf526b730f5a4_amd64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:4e2e35b6afc23e853e907050b82f405c6d207891728ff93b466066f99f970c64_arm64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:90a212ffbf689c1c9d0f8afaef542cf4cd9feb8da72391effef4f108b91f859c_s390x as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:9c6a85524d75533871329af0b6dfa089f443286399c375501d595b3f8a4a56e1_ppc64le as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:f92a748e4817a870c7569e23e5b932bac130e1d0d73a6a4de77f4f29e5e496cb_amd64 as a component of Red Hat OpenShift GitOps 1.19
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:0cae9c459339fc3c6a81664cb29927be1948ac162ed2c7d03189d12fbf66b89a_arm64 as a component of Red Hat OpenShift GitOps 1.19
  • +16 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.

🔗 References (10)