RHSA-2026:56366HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update

Published
August 18, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (22)

CVE-2026-6322 →CVE-2026-13149 →CVE-2026-13676 →CVE-2026-27136 →CVE-2026-53489 →CVE-2025-61729 →CVE-2026-12143 →CVE-2026-12151 →CVE-2026-25681 →CVE-2026-34986 →CVE-2026-42342 →CVE-2026-44740 →CVE-2026-48779 →CVE-2025-61726 →CVE-2026-6321 →CVE-2026-33186 →CVE-2026-45736 →CVE-2026-53488 →CVE-2026-53492 →CVE-2026-6734 →CVE-2026-9697 →CVE-2026-59869 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2026-6321 — fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies CVE-2026-6322 — fast-uri: fast-uri: URI authority bypass due to improper delimiter handling CVE-2026-6734 — undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing CVE-2026-9697 — undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-12151 — undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13676 — fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-42342 — react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-45736 — ws: ws: Uninitialized memory disclosure via websocket.close() with TypedArray CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin CVE-2026-53489 — github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore CVE-2026-53492 — github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents

🎯 Affected products92

  • Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:073a57882455684aee06b54847e2a24a62de08cfa19ba3db5f8019fec45e012f_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:13a4cfc07f51b5fb2c09b034546a25f19e1ada4956f3422ecfea3750237f6877_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:714c440d4104bd6c8e048cc076a40446a54c8699858ccd7c663efdedcc3a6ec5_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:a49c84a0a66b5150d5ce9c1c748d18df871a9789e09b52ba8fc28cdc0c9a61c9_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:f1272e4b51d0e7a7660f89c0dcc237c9f637f8f9974840c02ce870042efac469_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:36fbd5ff58ce8e66cd1bc715da903493a37f2911e31817db17dbc2296c356414_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:b503a08006b990547e5103c18336970dcc0fb5104c0421d27e12334f19a11863_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:d2f202633f6ec5d238eba42f385c2cd34a5785913434cbb42a3a654ca8942600_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:3f042df7942cc6d0b8792788d39b84bc2ca49249b3ffcb77ab3b7d06603cdbfe_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:4e0f605e3e76a269f451de80d0378ba27b31aa503ff6f9db9e75b0b9b279d63b_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:a476239c42d3cac3f1ba5fc2fd964ff813b96d3a2ebbf3101db2c9cfe078bf85_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:54d35fa2ebe0696f10b18c7701f4a4325968da8fd8be3f63a6bbbac0a602cdf7_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:20ff23682f8cdc4643bd9bf77cf7c74370fe1797747bf741701749f69af5bf32_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:6badfa824123032935d38952b2b1950a5528172782b26756ef63c973c7ae4df7_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:90aa6d2ac25e81fe9cd29de6202ac586362228d2d7a062fb180a842b049f485e_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:fa28e9ae764c7e8d2cfa03545cca018d3d1cfdeff3424b2ff6c62cf87d60a798_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:4506477cd11d6707c14d274c5d5ce6ff70525362f3e854e29e0e2929e36a640e_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:69b37758ce924888b116d03887f9b90311763f09486c5801fb184af6856b58dc_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:bd80cb94dde1def25c86a39d5a67681d0d6a2b56cfe0527927af0d4e70e0eefb_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:fe72132112f6c67f7b2a0942c56de21c806522367e084c774744fefec9c70617_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:d54bb64c94cfefeca479b6736463c93a683949947dd01435fb95277b85f1cb19_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:6e94f0a134de5aa4697db3166410d85eca7be08810b32ff09c593c677a4fa302_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:a23bbe68bd0ae322085a28e520c06824aaa46428cc9e839270357c92748e76e3_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:eea67de1407147dbcdb9d475dc5119b85c59781eee198ba29b83893908f1377f_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:f6e379434da19a00b70f772f10894bfd3165d9d626386d29ddcd0e78d5e24ca5_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:5eb4ba9b9f9f600e038853661baaf9b7fa80500ea29984cf1c6deef537c6a304_amd64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:a6291a20caf4d1fcc824b3509abd60271c30fd4b2ca11d5f0b805c1f59ff72a4_s390x as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:c872fb9bf72d36b29bb94f6dc97bf03554959277b4c3cd34f9d42a586961eb8c_arm64 as a component of Red Hat Openshift Data Foundation 4.19
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:d54215f1b92e64a148b46c4604c148542731a62439a56c2682f0415c2d832d38_ppc64le as a component of Red Hat Openshift Data Foundation 4.19
  • +62 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.19/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: The single most impactful mitigation is applying network egress controls to restrict which external destinations affected applications can reach. Because the vulnerability causes requests to be misrouted to wrong origins, limiting the set of reachable origins directly reduces the attack surface. These controls collectively limit the blast radius of the connection pool misrouting — the attacker must compromise one of the explicitly allowed destinations rather than any arbitrary origin — but they do not fix the underlying logic bug. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Upgrade to a patched version to fully mitigate the issues (ref: https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78). Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path. Workaround: For Red Hat OpenShift and layered products, CRI-O is the supported container runtime, so the vulnerable containerd CRI checkpoint-restore code path is not exercised during normal cluster operation. Customers should nevertheless apply Red Hat product errata as they become available to receive updates for affected operator, must-gather and tooling images that may bundle the containerd Go module. If containerd is deployed as the container runtime with CRI checkpoint/restore enabled, disable checkpoint/restore functionality until a fixed version of containerd can be applied. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.

🔗 References (26)