RHSA-2026:77321HighCVSS 9.3

Red Hat Security Advisory: OpenShift Container Platform 4.13.72 bug fix and security update

Published
October 15, 2026
Last Modified
October 20, 2026

🔗 CVE IDs covered (8)

CVE-2026-33814 →CVE-2026-44990 →CVE-2026-46597 →CVE-2026-59869 →CVE-2026-75885 →CVE-2026-75887 →CVE-2026-26996 →CVE-2026-33186 →

📋 Description

CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-44990 — sanitize-html: sanitize-html: Stored Cross-Site Scripting via HTML sanitizer bypass CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-75885 — openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint CVE-2026-75887 — openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler

🎯 Affected products192

  • Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:75d72aede5593d547ac0f66d01fd3556ffe24e535335557075526c6768a12c6e_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:96e4faa0b713f7b04bbf7adac1e3eff3d1ba0a8d75877bb08a5cbda7f797f950_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:79889ad0acb3db2d278c37068e02c7e1636ead92a1bbadb15b6040104225d0a4_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:df2c77ccdafdaaedcbd51f0b6dda9f2d7b12694a3a7dd8835623f266d4ced13d_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:359e2c4a5e247ef57d6a27f481f4b31412e96093f5204501d53bc062c4f5a8a0_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:474dd5bfdc617af4e91953df380cfa1181801689649d74bcecf6a14427721b72_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:6e4cbd638a14e25ae4f8d5a3a5141ed0b49e5bb4273f3b8b54504287d0160103_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:54adec7003937fdc2b335806b25ecc24eab4e0b64e70ab67579c4c42c2ab3c7c_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:9976bbad71c3a25002c511591d3bfcd1b35ecf2424adc2cc3cf5bd472f1c87f6_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8@sha256:de104d8fa3e7e58451a6a841ce45ded71f1e0cbf3afac52d6026066d9dc39069_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel8@sha256:ed527a479f87cbb32566eaa259d8563613573e0791a689944044ecfd38316101_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:53f0da136a9496f96b29f2fc096385b56181789de07d82c1d4dcb19412810dcc_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:770a7088247664851ab576ad1b79daa33572be305fa6c37e4b1d52faff99cba7_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:58e701c38286db4e5f71259268135f46a2ecba0f95f16839c208cc6d78655071_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-alibaba-machine-controllers-rhel8@sha256:c9f186a8664420433a808c24acd021f22bb2c09ecfbe88b4edba163d04b9fbb7_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel8@sha256:a90dfc907dec44fb930d77961ee2959d01c1d1cdcaf753b6f45d168446059b1b_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:9604e70f9b4ccb3dfd092da6c7ad63ffa433f185528cbf070d8313b55b11c01a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:5fba327a8f82a70de21ad04e9bce6079766b5a1d2c96611e6decf909304d0956_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:d95188e5bf33b9b06566b440afcd310662e3f380ff795586c29205f318f7ce75_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:b6613d99a75e252695f4a6bc1849c8a35318a90660b46ab0199e9f75472afb79_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:23966e08aad69de32de754972c13125d5f1bdb359c8420c52b21779f5018ee90_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:a9e68afebab92cffff56f591af45a53efc5575eabe19ee3ca6a5e395b3c32999_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:5421bb2032d751071e7f6bdc0800ae6aa4a5d24ad6ae07d26201bbe97370821f_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:127e864384eb628b7f9d2436c1dadec973239b99c037bcf21e9b4f8953154dbe_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:e1978fb1329a3df67a1f763ccf448b37b0d01f8c81a4746fac39c221cbacdcf9_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8@sha256:63a46f2a2ffa74069e82f0579acb8b313355a977df1863e2c2328038ba848c6e_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:3381fd2a6540f48278e378a63be4836a8c3c6dc2ad1a6388f6bfb4bf4622c5f0_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8@sha256:41a5821e2c957ac6d783d7ddcebe6142d40214f2d4c958c10d31a70365d91e4e_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel8@sha256:305ebcba523a6d768293d0c48c29cb2b11c2409a13c82da96767c72f366e4b47_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • +162 more not shown

✅ Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:c889dfb978becf40cea36fa5517cd6540944d49cba22aa4783aa1083b93e2470 All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: https://access.redhat.com/solutions/7148487

🔗 References (11)