RHSA-2026:70617HighCVSS 9.3

Red Hat Security Advisory: OpenShift Container Platform 4.18.56 bug fix and security update

Published
October 1, 2026
Last Modified
October 5, 2026

🔗 CVE IDs covered (12)

CVE-2026-33814 →CVE-2026-48801 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-56862 →CVE-2026-75885 →CVE-2026-75887 →CVE-2026-33818 →CVE-2026-44990 →CVE-2026-46597 →CVE-2026-56860 →CVE-2026-75886 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-44990 — sanitize-html: sanitize-html: Stored Cross-Site Scripting via HTML sanitizer bypass CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-48801 — linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-75885 — openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint CVE-2026-75886 — openshift/console: openshift/console: Unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding CVE-2026-75887 — openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:14a5870f390f2487b74832bd3f880717b384ae7f8c73db2c0d9c412e8ab78ded_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:be5a0411ae2db1895bd48902dd45e31c7334b4b90919e6d529bbd086fa1195cb_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:d45934e19ea0ae530071aa50ff3eca324559adc3beb43ef261d2deb545c625f3_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ff31655e5113770b6edae4ef2d744b423dbdc269ab00ee3484aeb7aa30758394_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:29390e2ecd937c5eafc7a0a3b4b852701d1928eed46d56804d629f76becfba8d_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:62eddb3383d24b72ade26dc88d140810368426bfb2d795da11c66a0518796c87_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:6c1900ebc918493c5fcfdd33051fcc3985282fa43a2ec1cc6c6fed662e2fdba3_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:b16d02d0ca840fa68c4304864ffe55ca092944660756b4feac8d96990ae4329f_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:549dc12f85f8cbc8dd99dba9dc21caee8201212c6e6babc0e1d7831a0f470610_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:b14d278e2deda8f709f7165c37db4aec32191d6dff5d7b7963d77b10c6968c91_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:ded3e9d152802988f747852ded197a85c8a485299286a8512874b1181c7d9a7c_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:f217d03b374be7bf8418e90f23abf8e4055a21a322422c641503351e2ba9474f_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:1ff45f8322807f5b0886fdb298769c162269511117549f312b207f987e63ef70_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b8324785ea9ad8d6dbc5d534df120fb4afd2a7842caa6b0fbbeaa88753bb2a36_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:bc9a5a04ab29f03bc18287f80eb3ad68777d156552e2f2a0b93fc772ea2e4b04_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:dcf1cd4bf14bb74ce5c917cc6af797c8eedbced2f3d581031381fe6441201cb5_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:0ed088aa756fe948754112ac6d35bb9e923eaf67cfc477fb3454ac4df123c192_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:831746f5124b80a592d80103718dc7b6536f75d3e45be6393f5a734f0289fe84_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:c08f037af41ebe3a081e9dc633f504b699f48aab4f1521bafd51f95174d2f9a3_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d5c553df64709e6dd109158441d25de485e867cf29b8134ae3fc94703b56d9a0_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:23c28b9bf3cd1173e48b8ba9d12dc759413cc1a456266f234b99cb03670360df_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:2edbe56161642c3f55dcd508828242336b862f2d67275ae19072c69e28abf060_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:b2a4ad833b4f06926a25f7aa80120dee123038125e6c5bb906c6fe47ef854698_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:f73f16d8bd5ad0f549eb6113dc23bde3b8fd608dc03dbef00ddf4ddaf5ea97b6_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:4e043989b6527ec0b7c08d8e0ac1ad202b46dd2ef22d723ab83aa7e109ee29a5_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:630e39a68eeaa6c75d33f9f6371645bb20ac23ded168cfb6df951111157a97da_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:65b885c9f3eb5e09b9038929f20df776a816b33271936935aea3b98595eb860a_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:d043c0f16a264edc5229b3a700d64d38d773a0b0c34e191f49ff24e83577601b_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/frr-rhel9@sha256:210b15a4a82c5858bf6e14afeac79cda6524ea6ae685724d5e24ed6a96983d1d_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:630c143e63c6024267bf6f66cfc7c84366eb8a9dc022eaf7b411b8e1474ca183 (For s390x architecture) The image digest is sha256:c8c83e4f0f69910e8c6b49781e588daf810d5d39dbfa00d4ab3303b6b3ea8344 (For ppc64le architecture) The image digest is sha256:d2c057433a1cfa2470110843b7820d42ffa5f29043eb245a7bc07e7b06b5b561 (For aarch64 architecture) The image digest is sha256:b35c9facdf6f1920dc6feb4d9b7a4699608ee6ae70dba55f7fc9a45218b16f8d All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (15)