RHSA-2026:83013HighCVSS 9.1

Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.17

Published
October 14, 2026
Last Modified
October 20, 2026

🔗 CVE IDs covered (23)

CVE-2026-27136 →CVE-2026-29181 →CVE-2026-32285 →CVE-2026-41178 →CVE-2026-42151 →CVE-2026-56852 →CVE-2026-56862 →CVE-2026-18140 →CVE-2026-33186 →CVE-2026-42154 →CVE-2026-42499 →CVE-2026-42502 →CVE-2026-63209 →CVE-2026-32283 →CVE-2026-33818 →CVE-2026-46600 →CVE-2026-56853 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-25681 →CVE-2026-35469 →CVE-2026-56860 →CVE-2026-84445 →

📋 Description

CVE-2026-18140 — aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-29181 — github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-32285 — github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-42154 — github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-46600 — golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

🎯 Affected products35

  • Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:fc457cd1699abd94a799380923a3770d10e5cefbbd3d244a8cb048b5739239a9_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:02d494c5932a14116ca296dd7fc6f102b793628aa7e8e5a617ca912b4ba669c5_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:87405cb7293b2e1eed9399855c2613b51a1e1190decd26ff48b3eaffe3c9c131_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:da07253a03c0305bb18f6cdb0a5e684e1b96e127b18b1617b3392a7b03c8c289_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ea114f7c9b3b456758289ecbf34fb7837b494bb8f855e5df27f0b3f8ad9db1a7_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:664c946b58a2eee37b1c74e1ee776ddaf2090839b6d6f3873f2c90eb13adc6c8_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:7503fd96fa13554c22bb728b825a2e5d35648f4f386d2dd809c99113780c5ac6_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8c11c24cfda6f2648ad661c71c1d0d2f2f389204e728e970dd6ecd676be1316f_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:fd1b9dbe9801c4bb64eb2e8bff58f144d606bf61ee8035dbfb797170b05b5a13_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:20544daae536c50dcc2bb54ca7e69ffcb7fd010c400d3d4a747d50cf5d553d3c_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:43c3e1d216744276ad7d57e05d1bdc3683f89448d6e6c3536b0dce682743f77d_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:4d8d79b549f86107ddd1a22ca1d75f0b1d03726d770270c099c0d7ec204caf22_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:ce935be45dee71ae91415b446f4f8fd9ce8dbe47e7bc434a87230413af8e769a_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4a5c0ec2222e4eabfa7d6fc9631955585d0ccc8b469579064b3146e9c4f7465f_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8a438b66bc1be55b3e498d24a8b9ac6ef0b2f9efb66070a6cc068c5eb656cdcb_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:c9cfac766192b6139f44b2e559bf6c92f2d336fb23f2f462b2bac4406973c4fc_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:d34bd1f6b4b38fd8f3f49b061bcdf696d0ef79017d04e1e0f5337438c22b0469_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:3c9a014c7720b51473510f412507dcd691b32743dd8ebfbd030142ea067f35bd_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4c180ef7811a1077ca9b142b646e7c114c9b8bd0165d4927ff289a69bac6c8a0_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:9472d54d1615b096109774cfb1cbb0a6bba7c24a21e50d470d3852dea854a9b8_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:bce120d3a124e83b9500bba8f9af4e0717547939b1270f7eefbee0b00afdca68_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:c240a88ec2f3d86677150528a2dfed2543d5f67d9144bb8774f42363656935d3_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:16e71627dfe24c5e2fc1c6f8b629c6869a8718ca3a5f0c6fd7ab02b13fa076bd_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2ea92f619a692f08d810905953cf28316bdaa672af994e4a4523f81890b09ca2_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:7d8ea5e6e766c7f6a3701cc21e3148bb06598d7dfce16b73dfddf32139c44717_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:8b7fc486ea02041c207eb4e697d26343571b505ccd016d2cf70bcab30dfac65e_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a141daa08d1b7d48886373616e1af6e555165c26bdc39ecad198080a8a9a52b8_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:aac54337c369cb67fb4d44cdb301960b963c21a06d18f38b43f00a347278858a_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bc76cda39657da8f4159cd11599b1bc01793df1911f933642eb80782b0be818b_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0
  • +5 more not shown

✅ Remediation

For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes For Red Hat OpenShift Logging 6.0, see the following instructions to apply this update: https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0 Workaround: Restrict network access to services that process JSON input using the `aws-smithy-json` runtime. Configure firewalls to limit incoming connections to trusted sources, thereby reducing the exposure to remote unauthenticated denial of service attacks. If the service is reloaded or restarted, ensure firewall rules persist. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended. Workaround: To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.

🔗 References (26)