RHSA-2026:66358HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.22.14 bug fix and security update

Published
September 15, 2026
Last Modified
October 14, 2026

🔗 CVE IDs covered (17)

CVE-2026-39835 →CVE-2026-56859 →CVE-2026-56860 →CVE-2026-56862 →CVE-2026-46597 →CVE-2026-56858 →CVE-2026-42502 →CVE-2026-44705 →CVE-2026-41178 →CVE-2026-54284 →CVE-2026-55204 →CVE-2026-56852 →CVE-2026-56853 →CVE-2026-27136 →CVE-2026-33814 →CVE-2026-33818 →CVE-2026-39828 →

📋 Description

CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-44705 — tmp: path Traversal via unsanitized prefix/postfix enables directory escape CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-54284 — sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing CVE-2026-55204 — haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:124f0a315fb322680b1eee99f64ba42e8f912ccc22cae08b3647fabe3c1ee532_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:7a6a949b42db0575c0038da332fda949b769f15ca0e90998906100a0c8c00d46_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:a05b4403a34f95110b4e8188056b29545990405a1bce8ec0452ab42ae8bc1d09_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:d86e388115e71ef9c4c0b4679ee8528cb6b80350b73605676002132ef1f01ba0_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:694aa181d7bcc0edf08fb0f192b44b21bfa3254dab99af726d2e2fc0e3d23c5f_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:b22aabaee46be13d8e314b35d54ad5909079f65b887492411b27b575f17dd76e_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:dc6a2bc642c6eefc92a63449e1098e4ee2b0be545d9ae5ee08e1bab857511406_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:e29e2fcd3ef15ef0402aa3a7f7fd21752807d7b1f9eb00fa9f025c23de7aa506_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:60ede5d267e61da6a026f0e9116fb2010c22a63e3e3f085c7c4ae54c52a4d6c8_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:6c454b36dbf61f3272fcf43c4774b902c61150f16364ead56d41bfb6415d0e05_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:9360bcec9d66aacb909eaa3afdcdad9749398e53b3d1b6300395f1391e8e481e_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:fcc61a21de3cee90ff64076fa9181bb7a5cc4044e1957b8d067e92981d71a458_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:7f671b86d24dcf9946c175800f0c67b6482ec70717a985d7a83611d25dc12258_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:c0a05f65ddc27ea84203c335671a871c62671e81b9753fecc2a160e99a9e11c4_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:db335efb89540faa62f9b48a29e7dc166d64a3b10d219dc5b906b50db5b2fe94_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:f12b5f13180b62181634f632173448265bdd5039abe7b0a0d5937c64442f3e0d_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:17a67de1aed3e364c675c25e2e9d22d01b2c143308849915986508c519bfc06d_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:b36ca43360f309caf87be10c91592a98c5c91a4d6f736f92a6d9c978936ad592_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:b4e2ea23936fcdccf0997eda0801972f2c101099c77f932874b4831492a00d4c_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:d4339b25c40fd26669e5fa2e0efcec784c778a059f9dbe3e4ffe28d325c4dcdf_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:2b825d37232cbd764a744b5a6c7ea821e492aa22f45716328d0c3fd2a653a9f2_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:70dbe7357178bdda20ab84561d3024a1d85eb6b4ed02baf0e9613df14eec0108_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:a815751439de9d3685c4115bf1c83488d965a7a16b343e723ebd343d220fc6d5_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:c956290bbc691523664910cf68270cc53cf641e22ee140f82af7986986619487_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:116d0c66ea8e0c3510942a2cd62f9f3f87fafd19c15c59c2f117baf89a669674_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:1fad839c9ed7d1e33ec9383d7bba92b1ef293f076df3f8066771604ca3a30008_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:cdd544d8f944ead8f458165ba5536f2ebddb51df352af85977bc5a0840359d77_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:e933bc71f9d436949d4b98149436f4fa409ceb815f071e3562df608e26ff0107_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:203144497820a3d1da98aaa0ef701244948bda9797390363fa6fc4669f23c018_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2 (For s390x architecture) The image digest is sha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac (For ppc64le architecture) The image digest is sha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407 (For aarch64 architecture) The image digest is sha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56 All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: To mitigate this vulnerability, validate and sanitize any user-controlled data before it is passed to the prefix, postfix or dir options of the file or directory creation functions, specifically rejecting or stripping input containing path traversal sequences.

🔗 References (20)