RHSA-2026:77552HighCVSS 8.7

Red Hat Security Advisory: OpenShift Container Platform 4.17.59 bug fix and security update

Published
October 15, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (8)

CVE-2026-46597 →CVE-2026-55204 →CVE-2026-33814 →CVE-2026-39821 →CVE-2026-39829 →CVE-2026-39830 →CVE-2026-39831 →CVE-2026-39832 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-55204 — haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:4441a2ecc35ae490d23e6bdccff6cd5793a1d84f3a886bf4d70e2f083df89a53_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:469c33bf8197e5b00c67a25defe4436eeaa394c0ce8c7fb4b65187ddd2725732_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:7858d92f2f81463bdea7ab6d2acad6a67b41c54160063f9cf25b75982638e154_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:a0ea69f97228b0faf5397cec6115afb0e57f10e256b5ead3c43c59519b7e5bc0_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:09edf64361a103332cfce8dd0d5d47d125f7be0e5b79e3b94bc49dcc35e6e5de_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:a9df5def7a150fe1ff5541b59c6c7a22b68422dfed41e0dbcac75bcbe36525db_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:aaf523bf9ff0ae065a069d409d5ae90bc9e2664fef5fc0ae3a24306aae1158bf_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:de0e293274eb6190fa548d2e775e65f0db904a4f0e9860b82cd5cb835416dde4_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:4a64d5874bf005d45b958a3d63b429dd838ccbe6785bfa9eb3130255f9096fc0_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5c6e0b75846f0b0dd46345a8a200549798e49de2a35a0d757aa3c6de37b41882_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:77cd90ad61b301ebc1b8c50621122f533e61f699c120027db4ae436bcf88579d_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:83a3e075b24ec7b1a366b4fbea34d9696cf8faff30024d66dca124db4ce4d1fd_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:41eb11321af50eac62884a0f233f8a4041316cbc114aeca44dd60a0d798874b8_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:c40e55a2a1fd33ccefb4610d392694fce0addc8b11b612c4ef3e51cf5a8018cc_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:c8775b95ac1c116a1bee53c3c0a8e5959385c7473cb8131335a9d4a53c604a1f_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d9edaddc1e26948bb19314893882d0cc75d07c6b793319055553d4fc1a64bddd_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:7523deeea15629cc2482e989f564aeb266cc1e9b4bfccc82c50222356db86cb2_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:780e62a0101772ee26be9a38622e471705038141ecc67ee57b8267aa73493d89_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:c40688f2524d28030b409fe472fe498cda4ff310de89305bf244832a53594da7_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:d7849666fe20b82a6c43a85dc5b2f207c58d73630995202352edb1eaf0ec2732_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:2722aa946d87a317dd5324b7ed07335482cae6ab7366007d44cec31b63fda39e_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:84ed6c7257a88c0351c945bf930a8f6be31b6833aaaf97964646b130bf898c1e_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:9fa77e22962cf6643bda01b16a6b4193200605bd11cd999aef630a9aa3bf2515_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:b5327316d161475d9fc00031658e0995172cf907fa02423d9a8ed1b10042b2aa_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/frr-rhel9@sha256:105086e646f00c288b2c41abcdbbcb741392a0577dbbdc3317e44348a46dc93a_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/frr-rhel9@sha256:355c01ef81ca150f304bbf6be99c0af475069e9fb74213522ee0c43078b378f9_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/frr-rhel9@sha256:6fbb8fe2cca6cfc85ac37d4ed95d2a5d99aac88124aea7d98bb18ffae854093e_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/frr-rhel9@sha256:8278131a8e90ed84e9195a4e1ac8ea13be259e5cbf3ed7fe0a9ed1d0c1905f37_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:498befe0e7b386acfd8225175d1e185befda2a76dbdcbc4d7653a184b22aef14_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:e94eed312b5fabec9333a6d27547fb01ccf528b3e5706a03a6916409dde24cd2 (For s390x architecture) The image digest is sha256:9492d83e666bc4538ef31387a98babb3e51fb64d88739b04d80e539bfee5db7e (For ppc64le architecture) The image digest is sha256:c52d165b02329c48e0c8de0c29d7e4651127a963dffe11008c4c5c17fa06eb1c (For aarch64 architecture) The image digest is sha256:7492314fe2fbe6b49cf3a0d8f59eeaf5911158a97a99d719d60165906b43b241 All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.

🔗 References (11)