Red Hat Security Advisory: OpenShift Container Platform 4.14 CNF vRAN extras topology aware lifecycle manager update
🔗 CVE IDs covered (1)
📋 Description
CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🎯 Affected products5
- Red Hat OpenShift Container Platform 4.14
- registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:78ff2828ac695c5170a94a784d6b1f41b7ce10904f143100b807fa83fb6e45f4_amd64 as a component of Red Hat OpenShift Container Platform 4.14
- registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:6779b385e609ecf4da78f1831094b91d87f3fe3709b0bbb3f41a639d8ace26b8_amd64 as a component of Red Hat OpenShift Container Platform 4.14
- registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:493f55acbbfd941d7d42f6ec8ec3a5c6bc8bdf6294d3d45832fec543c5679fee_amd64 as a component of Red Hat OpenShift Container Platform 4.14
- registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:c9301607e6b3ecd5c81493abe4b74edf79a2c4ce8c9c783aa68be7cb658b221a_amd64 as a component of Red Hat OpenShift Container Platform 4.14
✅ Remediation
For OpenShift Container Platform 4.14, see the following documentation for important instructions about upgrading your cluster and applying this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/index Information about accessing this content is available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.