RHSA-2026:79039HighCVSS 8.7

Red Hat Security Advisory: OpenShift Container Platform 4.18.57 bug fix and security update

Published
October 15, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (13)

CVE-2026-83589 →CVE-2026-96577 →CVE-2026-39829 →CVE-2026-39831 →CVE-2026-42151 →CVE-2026-46597 →CVE-2026-55204 →CVE-2026-33814 →CVE-2026-39821 →CVE-2026-39830 →CVE-2026-39832 →CVE-2026-49329 →CVE-2026-75939 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-49329 — openshift/oauth-server: openshift/oauth-server: Quadratic-time DoS via Accept-Language header underscore bypass on unauthenticated login endpoints CVE-2026-55204 — haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-75939 — openshift/oc-mirror: Release signature verification: OpenPGP SignatureError checked before signed body is consumed CVE-2026-83589 — oauth-proxy: Open Redirect via /\ and /\t Bypass in Post-Login Redirect CVE-2026-96577 — oc-mirror__release-4.21: Embedded local cache registry listens on all interfaces without authentication, with delete enabled

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:23a66c173a23a730baaf00e83fddf2e32a2558c4c86e23d7608d0de243c82e7b_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:2c14b08eb7d6e847a81366573e8dfaecae5bf2a54c4c08d1b8e8c75460e16074_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:4f1af33ae943fbf1780298d3c249dc7aa48f64fa92bc04948e68a6cdba77e110_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:addf8a0119930ff28c6b6e114fb17fbfc682d7bc5d1cb32b5eb9c99223232dd9_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:1d30dd00b277a423d28face129fb1aa2ac40b57cd2dd9ee21e68df8a20e80c62_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:9cf0e416a364011f7910e6a88f0ba7e4380c1d8f9bab452937b44f08f406c233_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:a7bac0ef1c4726e0c06a7406e162fe5fbc9e285a569f97811348db6f9b64533f_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:e64e40c0bafcec380d54b4ff73846bbaa976ded89465ba66cb2e3b6b091b7a5a_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:2c9d5e96750e4b89f056adb5162e263c078825c2261b9846e96d2dcd5195fe75_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:ba8fe3e47f3607f9f267c308cc1460cd80abe0204d1283ad4299941a7e31a677_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:e9062b73c313808d66497337820315d7a21bafb8c2cfa09e90b4a89c2db63af9_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:ef851ef6da28d4902a5264f0682efa42df0a00e3d545b13817e2e5e888aff33e_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:0febf66253a1246c32f04b9aaea9faa3468eb13321dc941208886d70695cb1fe_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:18e8a65891544f0743ea0945e8b12f7762dbccfcbc64bba613050814ab01122a_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:a8c7512206de915406b0498113bb20264957d8bf5fbd6b935548786ce538f360_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:ef8b72bd9c5ca6ed1e98c0e56bb15998bc5acb0c5b54682aaec267a6cffc5287_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:12f074572eefcb352b7aeca32d60191f3f21d4119718f6c8a6b08e50cb452f4b_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:314c058b004a86be8e349c8fa4e8ddad32ab8d60702c3ea70791cd23cff82816_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5f35da5e787d9c950f1eb79d2f141d1fe44ba10f89fa63eebfb3d35b036ffdee_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:db5979df3d919729bbe5147f106e4333e851304a52be195e5c636751786778c7_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:2e94a138965f665eab5492761521565514a248604f46401f33d36ff4cf153698_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:5bf456dd054f85e72bc3692e12586762f8bbe7758e7c5967588fc020f7aeface_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:833bdc9069cc70a8a71f7de363908135b3b56d305ab697e617a312dcb43e087f_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:b053b77f3373598bd4a9085f23660d78b6b04eb44310fe15e504e8a131331707_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:22bf9dc0d248f430fcec10b71df030571705e3653d085fb780385178e9122a58_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:2da0a38147280d64e88e85a2c4e46620c66c1b77aa08a7b4777796ba3f8dd999_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:a9cf1ff0dbdb4312ffd95e714e2004d0f80f07d60994ecae12f1ec0dc83a337b_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:f778192352489b924e9277a865f04bb855025e0909f8072c073208b042e64511_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/frr-rhel9@sha256:223a9066fa1e26b4a89c8532142c925777ff99b4bd92a3ff9dcd153c91ddce4d_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:7a0078ddb04d84aace3976582be4c7b6b3bf095c8e899a7459d3c61ec8bfe5c0 (For s390x architecture) The image digest is sha256:73b54cac46826fcbc423506e1f35ee5140b06060cf56ef5750c6837e3318c85c (For ppc64le architecture) The image digest is sha256:8b84765c92b6586f3a6a3747645484a36738ea1c2551013680c2ca85b5919d8a (For aarch64 architecture) The image digest is sha256:683a1a3232929b959d9476b537e06e017e3c4ab699b453a89ac891de5e06507d All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Until an OpenShift update containing the vendor fix is available, place an external WAF or load balancer that terminates TLS in front of the OAuth endpoint. Configure it to reject requests with an Accept-Language header larger than 4 KiB or with more than 32 combined - and _ separators. Rate-limit unauthenticated requests to the OAuth login and error endpoints as an additional defense. The proxy must re-establish TLS to the existing OAuth route, preserve the OAuth hostname/SNI, and validate the backend certificate. Do not disable TLS verification or expose the OAuth service directly. If an external TLS-terminating control cannot be deployed, there is no supported OpenShift router-only mitigation while the OAuth route remains TLS passthrough. Restricting access to the OAuth endpoint to trusted networks can reduce exposure but may affect user access. Upgrade to the first OpenShift release containing the fix as soon as it is available. Workaround: Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.

🔗 References (16)