RHSA-2026:5910HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.16.59 bug fix and security update

Published
April 2, 2026
Last Modified
August 11, 2026

🔗 CVE IDs covered (1)

CVE-2025-69873 →

📋 Description

CVE-2025-69873 — ajv: ReDoS via $data reference

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:051b7a071f478879fafeb72cb9044f6b2cd18fa2c6483dc3c4c980a52d415d77_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:3b26f11f424cfe0088f5ddc11be2f4e4a562b95e1d89ef8afb2bd086cc31fb17_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:df40915a48e2dbf497d410c80c0d8c4241cc9e50a30731eb15b5366436f3f3d0_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:f7588da590b24e9cc405bd59109d09f3046bf37305fc2e5b26da29651e82223e_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:2c7a047b341265c656f0fae0ffe3d7a795567b4741bf490788ed9c81e3950501_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:4cdeffe7a8b8d3757cd7978febb6abf7790e346b7f9f7ea84c028b08a163200a_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:c52088ab317b1e30a85c824e26c217d8073dcea907dc3c9502fc86aca86f5bdc_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:e0495d291012c2a231d6f886ea696e09dd60d8f40e6b2f60620b773d4c42a356_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:12e290355046e5f549a8cdae7517128f87ff3f03d5f25a36b5d8a718599d239a_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:74ab03d28abc171a23c493c17b5116b6a1235cf9a21b5fff2c9a1db24cea43de_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:ea4b1b706d596b1f85b08b21e0a1b63a31475e4addd288d6f0d0e94028c9980b_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:fbc7412064c5c4f6c7dcc8473da95f953534a31bbe49b21326d1b8de453da45f_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:01e9215b7716e72604cb20070c22e90b3018cc8a3bb4c47ff24ad4de9e5f00dc_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:0f4ba1e847fec5e9a3b63f7d154778b333643459228d41ac48959f6589957bfe_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:bad42fbb57b49339dfb5ca4dd0882d707249d74ac11a3e85f8edec2eb7505873_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:e82feeaae65417ea40580d5f3125c213e8f6b95a7921debb77221cd0adc37406_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:b077b4ca2e27e13b05c265c8acdf59c50dbd4a7a59b9d9dd4da4200a55a8e0e5_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:bb31d4f6ba51c99a802448588a475bf3dffce347d33881f3da36763b5d17a5e3_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:cedfbc0c49943d0050f68dea0b9c4757b27436f6dcb3ebca48470296ae722def_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:f1cf2508b6aeea813dd73746ba37eec67fb4cb6443a2d3bbd8abc0d2267c4331_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:6ad8b7e4c729b8f9bc42b2387ce3b6887610c22fed937cc07a03ec775f534584_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:8c58ad7ed30b5922d04336d01dd5cdcf35fa7d35ba40de558330932b6983efc8_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:ac50cdd09950ad634eb350219a31e2ea189f8281f00d52e92811e30e50e33c55_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:cabdde4581ab4aa592167587405fff8bc310c0576b77fc65013764182bd77c09_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:38a4a2ae97d1b1e465974b97b23135e9de76252f02e725449406a3660d971a06_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:80131fcc9c8fc87d4636a5f44fbfa9e73c25b1391f95f66c3241c8ccc3083d80_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:aef6e7b6ca3416d8e360bca6cd6c7fe54b883b97e1e3b86c775ca55e76523784_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:de1a387a24f617b5543294f8af190e16e14ac5bd1d0d6ea6a10eae6d55ecb27b_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9@sha256:34484b1162cc151a8688ddea4f7902759d79b3d87964e6d415681bf4977857b2_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:f2f70544d0d62fbf00d94cba09e89ca5bbf44169490ec86ff1f4f48ccf6401e1 (For s390x architecture) The image digest is sha256:d93e0cf6a690edb5b57d06044af75645ee966bf2a329b32979f62923afece8d9 (For ppc64le architecture) The image digest is sha256:4fe2d116fc96fd0713486b4f199cbccd8fb10fd196c09926717fcc99fe4cd914 (For aarch64 architecture) The image digest is sha256:ea723d901035177236056cfbb6341a431d65f7ef56c360fdc021bd47aab24810 All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters.

🔗 References (4)