RHSA-2026:65841HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.13.71 security and extras update

Published
September 17, 2026
Last Modified
October 5, 2026

🔗 CVE IDs covered (3)

CVE-2026-33814 →CVE-2025-68121 →CVE-2026-32280 →

📋 Description

CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

🎯 Affected products39

  • Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/frr-rhel8@sha256:4967ce4426d10e192ffbded45c25749825d4beed9fc8c2ede76b4f5c69ffff76_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel8-operator@sha256:2c663da22ae6b0b67e826366a91426712b60ab4fd3d8fc3a77b67de3e69f7372_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/metallb-rhel8-operator@sha256:adf413d7f637ae3b3c8cb086baa40444cc435608473ec626d1a28c273cbcf567_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/metallb-rhel8@sha256:8047450fa561a1ee5f55b9b16435abda649577a6bee933c3d04cf78d76c38ff8_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-ansible-operator@sha256:8e734ca7d14ed7bef6c5f84f5d58150e405b02f88978f484fc03e9887a1f20d5_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel8@sha256:2aded820cb18e5804cf8414313dbb753ed1602dbd434cc0f7a3d36275006ddbb_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:cbf636e0c1cea208da6071d7d681106be72fcb1ac68e250a2f0b25de9ae2b9fe_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel8@sha256:3d55da689b8504bc1f27cbc59c3c9470c088361260948a483cc54221b3ce0827_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-cloud-event-proxy@sha256:3d55da689b8504bc1f27cbc59c3c9470c088361260948a483cc54221b3ce0827_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-cluster-capacity@sha256:16802a8a45059698ad2a9c5014fec8fb0740d3a9309bc5a86c74360d2f258257_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-cluster-nfd-operator@sha256:779c844e521123630997046a42471c4abcf4a392b3a785b818e1e48b7e9273db_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:6fd8c61947d3847e5858d400081e29daecbd14aa56b5d09c3620c068a8cad84e_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8@sha256:da1aa232bf906494b7ebc7a8bceb0fe8ba0429b9c36bbcb83096399c9ab6ddaf_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:c7098ba88b21a1b0b8e0c861b2c930de0db0f076ea94dd051123c14260a3459c_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-egress-dns-proxy@sha256:70fa17eb5ff0eb2396a963d5a959822361e203a062e4979200150f2fffb82bd3_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-egress-http-proxy@sha256:3e6875f24308215a48a8e6bd36e85c75428019328aa71b2dcafa738d3165ab64_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-egress-router@sha256:4b1b36770ffcd469b6a96b54a1747228f796b905aadb9a6da4432bdfe3c4d355_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8-operator@sha256:846e3a86f8bc2407373ef1c7595d9606d3e0310ed127c317e0bfb1a4971f042a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:5dc42bd3d4394c16a743d5c8d2992c7f2658ffc635d23e04344659404a752b91_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-helm-operator@sha256:6158aacee8e8d7305d3d5e496dd8138bebb3dfe6ba0f7620fba25b9f0c3e3c9f_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel8@sha256:0bc91dcb8381ebfa75feebceff24976355cf3a6fce3557eb3aa79a04564cc784_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9@sha256:3d4811f49c25fe47111b5b956e4793ee7ea27fbf9a7a2d00ca7ab524126d8604_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:00abd55dab4d75e9c7c9cbea6a7239fa3bceb9a7ebaaeacd2840d77c2950c7a9_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:e9b5997b1f266e77c0e6463e60b3384fa3ecedfa41108d06425d226d853f9c7d_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-node-feature-discovery@sha256:a148dab70d92449dd77b711a8e9282ca363ced0097b23425a4da36b4f211f68b_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-operator-sdk-rhel8@sha256:2ea1622e77c29cd79a7bca0e747ca2789c106d4214485878336240a221b59f08_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-ptp-operator@sha256:7a2b71e4ed0bf29fbdd4f48d6113f9e3532ab59708522bd44af15dbab12462ed_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-ptp@sha256:fd6e268081fe700e84b978fe25610f1c1d309cb8893e9ccee40fefa936f99d0e_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-sriov-dp-admission-controller@sha256:ea27c3e4e57d9650192d41ee0974414a9ea766e4a4e98692ea9917c9f5c68ae7_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • +9 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (6)