RHSA-2026:65130HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.3 security, enhancement & bug fix update

Published
September 8, 2026
Last Modified
September 11, 2026

🔗 CVE IDs covered (4)

CVE-2026-16221 →CVE-2026-41178 →CVE-2026-56852 →CVE-2026-73569 →

📋 Description

CVE-2026-16221 — fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-73569 — fast-xml-parser: fast-xml-parser: Denial of Service via repeated DOCTYPE declarations

🎯 Affected products126

  • Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:a9ef792597309dd2b2bad4a112ac2a8aa1c829b66cbc4fe71b3812893007115b_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:6e691b1a15420c549db5e4a6e9b3a5eec6bc8a17e51bb817bd3fd17078bdd870_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:8cad5a5a1b38dcf49958020dd082c33a41867efaa53d9253e156e87e25fad6eb_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:a6d9c06e501ca1b872c623bdbd9fb948e2af86d43fe7f9bda4233ef3b9ac1ff9_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:fec67b0e416ebb312242d264a55492b4262335e3e6491dcebfa28248537bbdc7_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:29a5b024bbf8edf0a62046bad23f508821dec8b15db1cea7b27a00114d0c92ea_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:879e1a85f721d6dbe6f93975acc8509431f0a0d611f2ff05a65d2c65968a7854_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:df3eb7d369b579cc10cff5a31b11eb3e1e8e3fcb69e7b2cac3d36808a7aaa00d_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:df519632d5b6eb2ccbe04e4acd9888f4cf8053d63af3b8fee7b790257b385f07_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/devicefinder-rhel9@sha256:1867880e208217166bd1243993d77729650932d817e14d4768f819ab537d6b11_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/devicefinder-rhel9@sha256:2d8b04673999f64e6731a3ead0ae7ee4ba48c038f1d3eea4677eb887f6d18884_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/devicefinder-rhel9@sha256:8a623c48c5ef9edcdd32731113ce168b2416fba0c353573d73821c300764999a_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/devicefinder-rhel9@sha256:f798f8caa245b6f678e364d187957f822b4c1f3734849f343d68a982fef4c8a7_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:6214e40b774c0964ad6a5cb63719a01082def04d424492c7dc271580baff3c1e_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:a186ab41f6ede6fac926a184c56639e3468373a3062d9b5cb8460e2509004e64_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:a26a69a22c680071fb5c63811f32f198343245d9dfcc0807ee08a4bb62905b12_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:d582a9131e8af913f3277dad9ac44a976dda9ab47687bb459b10041291e94a94_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:47b195b679fad7b157db2d71464ec9f9606a425fc51303d9b84edf5d10d8deaa_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:2bb34b4026d1b2d45bc899754020891ffb01c73ff45c4c2f6b95034e8afc4266_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:529a6ae5c2166ec88d260b52d4923cf2486bf829eede9fe368b41d51e8134465_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:e9417f82845c5335462b2772fbfaabefc3a2e4dfc93ad4e162fda56a68646aae_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:fbbea9977cc8cf8db3da6c0fa003cb99544053da0bf7960a582f56b680b8fcd9_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:95491e857cf7d2f77079f9e9c5b29ad70939c4e0a265e76801dcad1bdfd61b25_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:cb0519a7f5a4ba2063f138367a9f54b38430894a62e4b3df65334964dd3608a4_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:cb6fc07bd0195654493a3579f24e5b4cc4e408571ff8923232aa742b957825c3_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:cc83b81dd5a8e8a1acfa8723b1ca272b8959c5dbeb63d06c0253a09e63b7b8e7_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:49cf4bfb6a41d7caf1ac9b43a9e0e453f3bc9bf105e5b34748cd60b8410f515b_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:3b4fbb7c06c7c08e9281be7129b506bb75ee43edc9e8f70cf2f6f9c9eaa55534_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:3da9265900f8be9685dcebff8b92cda8cbb7f33bd5f59aae14aa0b2debce1e35_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • +96 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.22/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (8)