RHSA-2026:57013HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update

Published
August 19, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (22)

CVE-2026-6321 →CVE-2026-13149 →CVE-2026-53488 →CVE-2026-6322 →CVE-2026-12143 →CVE-2026-12151 →CVE-2026-33186 →CVE-2026-33747 →CVE-2026-44740 →CVE-2026-48779 →CVE-2026-53492 →CVE-2025-61726 →CVE-2026-6734 →CVE-2026-13676 →CVE-2026-33748 →CVE-2026-34986 →CVE-2026-45736 →CVE-2026-53489 →CVE-2026-9697 →CVE-2026-25681 →CVE-2026-27136 →CVE-2026-59869 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2026-6321 — fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies CVE-2026-6322 — fast-uri: fast-uri: URI authority bypass due to improper delimiter handling CVE-2026-6734 — undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing CVE-2026-9697 — undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-12151 — undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13676 — fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33747 — BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend CVE-2026-33748 — github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-45736 — ws: ws: Uninitialized memory disclosure via websocket.close() with TypedArray CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin CVE-2026-53489 — github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore CVE-2026-53492 — github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents

🎯 Affected products103

  • Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:3a4211594ab157eaf1e9e84f0e036e6c94e272c6adc4887d27acc7da6c25546e_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:2ddaea535655457fa0c0182edd49001701d57be7208567c25c09e513b105bba1_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:3afe44be9ca582caf9a9a87ee4a4aba0b649df8d7e268110ded40a6e684b7bcf_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:7757463b71023645bac40673d6684a7dcbc479e11ee19bf33f37daf2b950f98c_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:ebc44b5e978f00be3360ae06bc28abff97237c7c0cde315f1d0835295e3c184f_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:729588270355013da1d18c819b5f00816fe9881bf20781e8c2214f1f367f9d2d_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:80b189979e7cd53dd6ae95756e99eac30d0a9b9a9d252e8b06a8d9b9bfd57ec5_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:97618364f635a8f2fc23a70b9eaf6e3f8b924c581b336a45f5f53681d201d3c5_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:fbddea85f951d45223bdeb5870071bfb0937b870574935ef750b8bbb48757f4b_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:135f6dcd4a8e3794c1f52b55dc52c5d1fd94ee0bc1715d95753b50838ea01f83_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:7640ace5828c598f5c5a8904d3f727e20a688fedac068b53e082bd287439b774_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:b9f41d2684cad7b927677b9c437d392521132b39117fba67e118f5e6476426ed_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:ed7de6628ef5e48f8b098eb15d2c44e486e6824421ac8411f348945548b02fb9_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:173de85729c10897e6dfc4b8808053c17f3f23a6b9c090f85f733b91d5fd3257_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:6bc4a8ad857b7e6d41bae3880af59ab951c8c7b3c19d9769d948a990145c57a1_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:867e990e7bc7e336137046149ef8a8595d25c899118997c1f1d6da66a2d45e69_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:ad7bb1401da598b30f797da3e9e19f94c19ab951784b1bf3456201ceac58aeb2_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:f570dff210dcda77386009de06765a7cef1aaba615e3311bd0a8928409e5175f_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:bca244dfe6001e5d68abf5aff64dc1547044f8c1404b39c908a59562ab38b401_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:bfab0e055441ee67d729eb7fbaf40631c698f9e30cc0d107370ba7840fba4c84_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:c06cced63171c0ea23c249c696b76cbc9274565ae6f8e09539a171e3ace97a05_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:e54149a0e6b64eeed55ebb0a40266decac1c337488adb64b9a34f4c156ceab63_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:0a2df491e16cab5f896d8eaee668b73205a29dd75276a6d5f6691500a552fc23_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:26d4a52961a3c5938201d859ed24d382932d9a39a306d2f5a8a869faaaed1397_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:5bae08fbb70dc1daf651166082f147734491042f8e42aa0ceb496eb6b88c679a_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:919998aee33c22472d4080d24dc6235c5daacdeed952db4f95a41727989ab4c6_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:a1e2052bbbd03e2cc956d5465bca5e4b5967480126a63e49380263e4c2943365_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:3249ae3bf73e57e0dd9ef60ac2d9087f013132fc34a8c8eeb281c0c755d91f2c_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:662911b1e3897611a5b2161a4780f4d96444e2a1660f4c2663707a8d0b3a2701_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • +73 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.20/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: The single most impactful mitigation is applying network egress controls to restrict which external destinations affected applications can reach. Because the vulnerability causes requests to be misrouted to wrong origins, limiting the set of reachable origins directly reduces the attack surface. These controls collectively limit the blast radius of the connection pool misrouting — the attacker must compromise one of the explicitly allowed destinations rather than any arbitrary origin — but they do not fix the underlying logic bug. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path. Workaround: For Red Hat OpenShift and layered products, CRI-O is the supported container runtime, so the vulnerable containerd CRI checkpoint-restore code path is not exercised during normal cluster operation. Customers should nevertheless apply Red Hat product errata as they become available to receive updates for affected operator, must-gather and tooling images that may bundle the containerd Go module. If containerd is deployed as the container runtime with CRI checkpoint/restore enabled, disable checkpoint/restore functionality until a fixed version of containerd can be applied. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.

🔗 References (26)