RHSA-2026:83503HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.20.43 security and extras update

Published
October 20, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (4)

CVE-2026-84375 →CVE-2026-33814 →CVE-2026-46597 →CVE-2026-59879 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-59879 — immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

🎯 Affected products162

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:40766560e28cc156c70aa231a2f72352af0844c8cb0411cdf65f8dd79a842450_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:9beee1e84669c59ca52b9196d4c2d595237e48b57dff889cc3deb61b89741de7_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:9f8e9b2ccf0dbae13c727e8818aabb2a38dfb76b7d9691ea7f839daae82a0d3e_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:cef35a3737c482e2278754512a25cb1c97cc1e5f2457bc7cbcb363873407c7aa_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:6e141d00d20a2c2ba20b95fb78b3f70b65c2606f031a514b2b5c0602e6da4023_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:d29bbd545cad7d934bcec737b36b243f14392ee5e8e0d4bdc97147c1af93520b_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:e03881703431cdd7fc73c91ad2c5646951306c860ae4c3df82352cc6f427c096_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:e30384a70d78f112f3b1a489bd61fa063cb3e22c1e31fcc18262ca3a091dcccb_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:522dad8dfb6fe274ed26f44fe18021f371afaf4b0f064c66524d3b99c2899640_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:6766d782dfc7603d222cc201fb67a3ccb99916ff23610c487288bf801705ef9f_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:9dc8d5c3036354ca867c6f877d3b4296134dcab0645b47b3de8334260731372b_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:d91e167117bcdcf990ad18a7dd86bc8f5f817b0c42c200333082e1c3533f9931_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:2c53d6324d5cdd12d18f1ce9baca88047cab693b05c81b8302e7d1a6c06537b5_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:5b09d347e7bef652858c89898fee8e0a88b6a31de8e8577293beb995c21aefbe_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:deba1a32c5316f3b071ac889ae2bde5b862763abd0ca403af229c1f7a35aaa6a_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:e278966a866c06d61689e8259a25014bdf7e7987ce54aeb5a365edb39d23e972_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:0e80b99fa907293c640ee8b15b458757427cacb8b70846ac81db19b4e9b4a7f3_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:2a90871784ae9fcffa99df2994cc637f05c9f5ec94f5bda88ca0d1ff923d358a_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:31fe107e17c0bdb9987c54b025d4f66b8049d2f27a27ac3da37f69ccfffc8282_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:e1be1f6815f62f6cdcd72c14b386000e0b44588d1da12a80f18e9511af09a8b4_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:181ab303ba25795b31cc04b81b70c0ba9d3482c16fb4bd8c602cf4f991c2e233_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:8021779e784f5df226c50d34a7ce2963be1a443063f789c8b78f49b42ab2d18a_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:8ecf48cdae26175bcc5037176ae707b0f1ba3c23d1086712aafe5ae854442c4f_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:c048af678e3d5928cc337ee058ccda03f1fc49837abec6e4c8502c1ca58b73a2_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:1bb0a4506a8cc29c36e0ef10c0baaf3c31b79181ec94430c56b16a44fd8cf412_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:216a2721e74fe57c3bed247a247d83e4fb7c4b3b4ad7841ba76d34c11cc68c6a_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:56f0dbd60a3d4d59ec251729813c2ae6eff6c28b1ce2492858b33cb84a05fe6a_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:ba1af853a432298e44628c0085b4712d76ba954a55515628ff846f83088c454b_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:127bfaa220de9cfe63b159d9c3a69625a130400703134ba03a29a9f5241808d9_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • +132 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, applications should implement input validation to reject or clamp any externally supplied List index or key-path segment that exceeds a sane maximum, specifically values greater than or equal to 2^30. Additionally, running request handling in isolated worker processes with capped heap sizes (e.g., using `--max-old-space-size`) can contain the impact of a potential process abort.

🔗 References (7)