RHSA-2026:79320HighCVSS 8.1

Red Hat Security Advisory: OpenShift Container Platform 4.20.42 bug fix and security update

Published
October 13, 2026
Last Modified
October 13, 2026

🔗 CVE IDs covered (2)

CVE-2026-27136 →CVE-2026-33814 →

📋 Description

CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:05de79ea7e7c703c0f3c1dcb0475f8fbacdbad8bfdf9c8e24681c6075fe551b1_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:3825b367fb6447a6eaf8a8dbf826fc3a59732fc86869235eb22831506ac06994_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:722ac671d39945d0fd23ed5524d0baf81bff3bab31f67c3862f6edbdc01097ae_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:de3050b7316550fffb001e2b497c639e6e3b8f5f8089729adccbd8d611784be8_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:bd65708cf1e79cefd6237bf3a12c25f050acf6e514f92e5ab71083571d6de794_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ca241ab9200d5905c1581aaaebaaf42a98e9bfbcc48a56197cccd6df42518cc4_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:d3e9e34d35df9fcc61d0f3dfd64db1c53ba462b9b775e2853523760bc293be87_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:f0f5e7682a9fd44c8ac9648d7f49db83f71e6747759ec095b8375da17254511d_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:61ea037439c1637e9b0f0173ffcb29870199664dae30c3a242c5b19de76a1474_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:771ddef202e5613cb028783a46e55039be697ba6617ca7f9d657d8fb00ea1652_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:8748a5cf3335e4d164258d644743dcce40c731dd84c006140005261713f6ea84_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:bdce34e61a4aa9c285fab23e11711429974de25a80f6d7e2df0de732ec7d6243_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:7d2c10d77833798684c1f00d661621e3fcec85c7c25a912c056d4946fa266dda_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:b358892602c7b923a956981ab99e9b164953e32109d9f6048e4fd7ba937f4f5b_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:c59f1878be82c2c11df6aaf78869374253b9131652228b6cf3c0a3520ecd88d4_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:d496e9f2c2f19bc62c68647863d0751a294732026b4dcd92835b2dc65178f9ac_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:2a1207836810ca517e5f2801259ca9ed7e50729a922016602c3cec871576e7c4_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:9f243d6f71895cb22b622ee7f4d7ba5dd43e32fc0239bdf5b356b1149b52fb45_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f923eff051dafac67c6643e7f4a4224612a6a3d7766f9cc97dd2757c65d9bdaf_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:fd95abe4371e12ada49347da47988c565c8db0835b59180aca310fdddcb03dd6_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:2f09020b7cb536e829aefe368f3eddc8f706cada4213a65ecf2ef4e2d354fa7c_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:535ecf5280249f4a12541c682e208ac2785ed0e5c23e857135ec32ab682147c9_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:7e5a6d48c7724715185e7e052e22f871af9e8f9e8cd9aea02a2943a4ab83c774_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d5311175f53b74e2663abc50d888d22518e79dd4f5af8366026aa69bddac62fd_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:4e76ed4dac3d9d091da2bebaef6c71e5e7c86457dc2e980b21cfa4d88a95b9bb_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:912b09337976b78095ef609afe6cfa8a8eb4fe9315b96e4312763b14e1da57b0_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:c1aec1d8bce1f0766e77f84d12c094613a23b10c3d94de94116613d3650fa44b_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e5d3dab9cae93ccdfefae927d197017c3549df0af851517b2cac40a50d2c3913_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:4be8d72219f2676a9319ab92374cf6f16a0cf2b0292edd9379425b2bed21e225_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:d20702b31fc7c2b0954042bd4723414f1f54b121fe9813dd2c06f9325088d0b7 (For s390x architecture) The image digest is sha256:5e846d6562a36c5222ddb36f14e9e3f53152bf25da8f24d329cf6cef6a81716f (For ppc64le architecture) The image digest is sha256:2b2a6c9ef7fcaa549591cd3c7de5fc67f19fb41d76b25a82e717b6dbd2138e15 (For aarch64 architecture) The image digest is sha256:2f1aba36c7ae3b073d6d6e3031f83adef10968b4d76cca1638a83d2ef5fcfaa8 All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (5)