RHSA-2026:56431HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update

Published
August 18, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (42)

CVE-2026-33672 →CVE-2026-35469 →CVE-2026-48801 →CVE-2026-33186 →CVE-2026-33671 →CVE-2026-34043 →CVE-2026-2229 →CVE-2026-6733 →CVE-2026-11525 →CVE-2026-12151 →CVE-2026-40181 →CVE-2026-1526 →CVE-2026-6321 →CVE-2026-6734 →CVE-2026-12143 →CVE-2026-13149 →CVE-2026-33750 →CVE-2026-41305 →CVE-2026-45409 →CVE-2026-39821 →CVE-2026-41650 →CVE-2026-41907 →CVE-2026-42342 →CVE-2026-33349 →CVE-2025-61726 →CVE-2026-1525 →CVE-2026-1527 →CVE-2026-9358 →CVE-2026-59869 →CVE-2025-64718 →CVE-2025-68470 →CVE-2026-45736 →CVE-2026-6322 →CVE-2026-9697 →CVE-2026-13676 →CVE-2026-34986 →CVE-2026-48779 →CVE-2026-53550 →CVE-2025-61729 →CVE-2026-9679 →CVE-2026-22036 →CVE-2026-25645 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-64718 — js-yaml: js-yaml prototype pollution in merge CVE-2025-68470 — react-router: React Router unexpected external redirect CVE-2026-1525 — undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers CVE-2026-1526 — undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression CVE-2026-1527 — undici: Undici: HTTP header injection and request smuggling vulnerability CVE-2026-2229 — undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter CVE-2026-6321 — fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies CVE-2026-6322 — fast-uri: fast-uri: URI authority bypass due to improper delimiter handling CVE-2026-6733 — undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. CVE-2026-6734 — undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing CVE-2026-9358 — postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization CVE-2026-9679 — undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding CVE-2026-9697 — undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy CVE-2026-11525 — undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-12151 — undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13676 — fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization CVE-2026-22036 — undici: Undici: Denial of Service via excessive decompression steps CVE-2026-25645 — requests: Requests: Security bypass due to predictable temporary file creation CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33349 — fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling CVE-2026-33671 — picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns CVE-2026-33672 — picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions CVE-2026-33750 — brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern CVE-2026-34043 — serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-40181 — react-router: React Router: Open redirect vulnerability via specially crafted URLs CVE-2026-41305 — postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags CVE-2026-41650 — fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences CVE-2026-41907 — uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality CVE-2026-42342 — react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint CVE-2026-45409 — python-idna: idna: Denial of Service via specially crafted long inputs CVE-2026-45736 — ws: ws: Uninitialized memory disclosure via websocket.close() with TypedArray CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments CVE-2026-48801 — linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability CVE-2026-53550 — js-yaml: js-yaml: Denial of Service via crafted YAML merge keys CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents

🎯 Affected products82

  • Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:22109b609bd977065bcfd86110ea84cbfa35d120ccba1fbf110758b7f33cd846_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:21b851833c425cd0638fa0d97672b30481fe6196a38817955500f10f3516acaa_arm64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:4e29a09b15c2149d96e02b302dfa5c89d88e647467427f251d7dcc949710a153_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:7bbc972cffbd7c92a685e1cfb73365b261908046ccd7b712659b9b47737dfafa_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:dd66f2aabe08104f33b6ed32786947f9b91c37404d06b46838397c8c791dad0a_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:5e63bdd0b4345a25ed76efcc62a068f88b0c688328713e1711ca4cac73f96d76_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:5eeddca3c800ec55d4d7dd479cfcd1751394b40e481b86433cd3838d2170952c_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:fd06b75eb32cf69d0ab0c18eb922d540f0362d12aec3a9029fa77e13f307cb3f_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:2156c85468c3bd37a4a9cec2538aaf529fc4317b1cd56705c4f39247dbc1d1ff_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:3701ca9bcf39e032702226a25a2d1a1ceedb2c9dc9e5bcfedc0104ad9d11e8c2_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:86da6a6280816bc50f36041e7a979274c3a5b27a63bccf15507e1f66afb49464_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:afb2e5106fba487ead34877b5964182b76e56384e1bfd99b230e35b0a12f0281_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:0b4d42e8e476f817548053fc8363084c60e7c4c8278fdad46f89752c422318f7_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:0bdec5fd8a2a4df637a6dbe6da3c7aa7dd98e424f6ccac1b666069240c3c6a2b_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:55d1e96c46d7e18200d64878901161cad4a2e5ddb1bd2ab35e21d0e63743db4a_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:65e384de217a7ac0752bd0bd7e39f2a16d3d55023b7e389dbfd6223e3050caef_arm64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:13e09d8d7196c9c24af4756aecc76226f5193a6fb8efd6314d72afb1ee8b08af_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:339175c0cf3bfc97a1b5f1fd40be12b124b9eadd7e3990b40c01cc2c8f202088_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:bb3516bbf6e6eeb5a9949de05c19d80a903533c0fcf4a756ff7f68af793a516c_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:caa566db111b5c41f692b06d1ff10a5bc12bae630b7f19cc688332cac459a313_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:06e77572fb0925499e831cea92e04009dba079413374794f89087484bce54ac9_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:8251a421792fffa707904b2d23b15b11fe0e2d85b526824e7c64d74c90a582d0_arm64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:bec7bd0e64563d9df240e1be1b717db34ad76abbe1665404cb77f26d6b1cdc36_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:caf3ccf3985ba2b9308567885b17eb0ab34ffbbacc194b6459fc0f9f8a612974_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:126f56171f915a0a53f6f5dcb315855911aa40a91c76a5f8188b7a7a103350d5_s390x as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:3457ba8cafdf27bfd21fdf20314da9141b263034026052d5543846397b38eafd_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:d31a9f14f99c50f2a79774147289e5715e321f2db4c9b4ef938feaad31882c7c_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-operator-bundle@sha256:435fc527a5f9ac40447a9f14a4a91a2334c0a964eb1479a4d800d66534d91e90_amd64 as a component of Red Hat Openshift Data Foundation 4.18
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:02b74a58540b0a6cb4e887843fa2b6adad58506af305b73f78b415ed5eb26cf5_ppc64le as a component of Red Hat Openshift Data Foundation 4.18
  • +52 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.18/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The single most impactful mitigation is applying network egress controls to restrict which external destinations affected applications can reach. Because the vulnerability causes requests to be misrouted to wrong origins, limiting the set of reachable origins directly reduces the attack surface. These controls collectively limit the blast radius of the connection pool misrouting — the attacker must compromise one of the explicitly allowed destinations rather than any arbitrary origin — but they do not fix the underlying logic bug. Workaround: Upgrade to PostCSS 8.5.6 or later. As a workaround, validate and sanitize CSS input before processing with PostCSS to prevent deeply nested or malicious structures from reaching the serializer. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, applications using Picomatch should avoid passing untrusted glob patterns for compilation or matching. Implementations can disable extglob support for untrusted patterns by setting `noextglob: true` in Picomatch configurations. Alternatively, reject or sanitize patterns containing nested extglobs or specific extglob quantifiers like `+()` and `*()`. Enforcing strict allowlists for accepted pattern syntax can also reduce exposure. If the application is a service, consider running the matching process in an isolated worker or separate process with time and resource limits, and apply application-level request throttling and input validation for any endpoint that accepts glob patterns. No service restart or reload is typically required for these application-level configuration changes, but verify the specific application's behavior. Workaround: To mitigate this issue, applications should sanitize or reject untrusted glob patterns, particularly those containing POSIX character classes like `[[:...:]]`. Avoid using POSIX bracket expressions if user input is involved. No service restart or reload is typically required for this operational control, but applications should be re-evaluated to ensure proper input handling. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Application developers using React Router in Red Hat products should implement robust URL validation before performing redirects to prevent misinterpretation of protocol-relative URLs. Additionally, applications configured with Declarative Mode (<BrowserRouter>) are not impacted by this vulnerability. Users should exercise caution when interacting with untrusted links. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Upgrade to a patched version to fully mitigate the issues (ref: https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78). Workaround: To mitigate this denial-of-service vulnerability, applications utilizing the `idna` Python library should implement input validation to ensure that domain names do not exceed the standard 253-character length limit before being passed to the `idna.encode()` function. This operational control prevents the processing of excessively long inputs that could lead to resource exhaustion and service unavailability. Applications that pass user-controlled data directly to `idna.encode()` without validation checks (e.g.: DNS length < 254 chars) are affected. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.

🔗 References (46)