RHSA-2026:77316HighCVSS 8.1

Red Hat Security Advisory: OpenShift Container Platform 4.12.100 bug fix and security update

Published
October 15, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (5)

CVE-2026-33814 →CVE-2026-44990 →CVE-2026-46597 →CVE-2026-59869 →CVE-2026-26996 →

📋 Description

CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-44990 — sanitize-html: sanitize-html: Stored Cross-Site Scripting via HTML sanitizer bypass CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents

🎯 Affected products191

  • Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:8f9932f0262c9d457aa3d4e39c0494fd98dc026970167c0bd11274526e1f0edc_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/driver-toolkit-rhel8@sha256:de8178ba72c7beda857d170fdf189d18ce977de0650944b71d4546f9f934c771_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:4b29c6d48e4d1ef8e53cbee103687a07c2a248094e15afe41bedf1c68c1e513f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:9b9db83fe7d85b249311075cc60f7256d2b1ce7adebecb6bf01e743537b400c7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:488a7df5f655a08d0891dfea252a85a27391052f912ff93b95d8e171eab2e8d5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:3a3f8d0c14fc155359437578d979efae88cec97c5908f886ee098da4430d3c78_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:56810fb99b0e5dcdf38326413eae60562c053265d23286a8c720975e18f6aabb_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:1e97883186c334edcb5525bc4c08adb5821be54544c33edad4c7a0ad54e5f5a4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:fe1297c3d1a5466857d16c1d7552900686d18b6bbb58db1dcbd7d389e49522a7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8@sha256:df6830ea58917dd702ca7e5a7209835af7ac1f125bf2c71c3f914ee019b3cc6c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel8@sha256:0d9d282b85122b75b9ab9a19a23dc7dd2c689ec1d8d901df35b66c1cddae7b4b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:faf18d608aea771b5b7b54024cdbd4d642f05394c564b48130615a5c1f8f509b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:b68c2d342589488ecdfb3c689a2e52a76a0ee87f3edb0ec5160e4beca60f2e58_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:d58518d14c909c8e847d043de3489b2502c5e8435fb033673c3b05ef3a694ea0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-machine-controllers-rhel8@sha256:a20c02596911a989511edd74677164ff5590fda3865aa85c2e6ba839770b015f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel8@sha256:8cae706dfa300ee96d69fb3b5a56913b93ab24a20909f9ca41dffefa6c070f1d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:ca1ef18f4af04b6bf939c47b89b17d5080480973db29076c4c79943935c9ce2e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:f516bc6552b3e74321f99672c397e27abe99ee21a75789df94d5496d44765217_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:d920cbd237f8494dcc78bd98d0d7559c99a1e616e9a11349335a08c8ec0954af_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:034c5fea0e8cfc1bd233af45320433a78d98e193f19713b9d26ff879145b2ca4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:8c7d8cfe79a776a7fc93a0d5e9ac973a7f4a5a623d3fdc3d6703189a4ba56ddc_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:fcbdc7797b6cba3ef05b439fff9bf476d138cf632dc19be45009202bd84b1de8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:bcf8761a29903e5c2fd67d8fcd14bf0238b2708ada097891a79a5a936cd9380b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:fbe87a5aa504617d9a80bdc037cdcf3f373f421edd0797a1e2122694fa043fa0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:dbaa71f6626cf2171fa870a1f9d4749042621e7d447c922b76b46fa04a3e1537_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8@sha256:83b5cc82eb100bcf6152bd6b4a95cc8f7d9fea437fa309da145ad44bff12b5df_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:8ce6ecd29f2d310d16d32808e918445dbd3eb2a01030b2f48c96633e41c1372b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8@sha256:edfe23edb4550c417781d346ab8a4791d0057d7f8f72e1b4b18ce5fa096760f5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel8@sha256:34512a71ce04ead7480fa1263210eb5e71dbcd3693ea791beec9e238ea89c9cb_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +161 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:b1f63f02655ab270f06682eb164dde22691e423df720fcb3b9db0436e801c42b All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.

🔗 References (8)