RHSA-2026:83619HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update

Published
October 15, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (13)

CVE-2025-68157 →CVE-2025-68458 →CVE-2026-4800 →CVE-2026-26996 →CVE-2026-27904 →CVE-2025-13465 →CVE-2025-15284 →CVE-2025-69873 →CVE-2026-33186 →CVE-2026-33814 →CVE-2026-34986 →CVE-2025-61726 →CVE-2025-66031 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-66031 — node-forge: node-forge ASN.1 Unbounded Recursion CVE-2025-68157 — webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects CVE-2025-68458 — webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-27904 — minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products76

  • Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:0ed5d201a50ae37abfcdeb09cbd8830cf56d96b941b2a488ff7d53934a2e35db_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:a3bf720542882928f31d8b4e88ef1743a5d4f99eee970ecb3839073f4b128f36_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:c230dc34e819a0622edba289abdc86afd5e1cb9fbad6e35d7cf1f4dbae656d25_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:4bec80ffebd13d9849549eb21ceb1dea62a9718d332e7b33149a87382a2bcf1d_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:4df9b5768c50e96dd44edda2467d1ef67d12d09b38667cc9279b83a57896b772_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:d424328e9bd5ef11572688ee3b727b5cff064b10e0d5b010bc57beb36cabd10b_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:9ebc1d860327c3272c7f9ee46958376a8325bc9faf5ef1ff4d5079fa266d7a38_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:3778b378dbf3dabb9f336ae0b8a3ec640dcb58c8d327815276f90fc2a7607608_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:a28379916c20c5e1c6e024a6117cc2306ddb700c84d5c347046b66ec751b0b93_arm64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:b4b445819737d8b58400704e5ca648c1127066342360a63c01c5fa30315af371_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:b62e6a10d30a5ea19ca30c4c166e8dd430eeb529d4c73db359bcf260a2c5372b_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:d256d33813522f5e7d1963892f77eeb9c972de1b9a1dd15ef57e84666872d4a9_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:dc45b16694569567e0ad9636d5473c1eb07df9cc5f7e33c51b64da6b8278988d_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:dcfcb023840364c8c806b37b5abe3b103c17863fbd4af80ebbfadf0b60f90d9e_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:fdc18fdef7b96643719eb021010b57d324772e412da3208e5605377415032ca3_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:6d94bc86c999d01b5780074d2002e44f3ff3667ccdf77bb1062e81245460614b_arm64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:785bc1978cdc5e7698198bec4934aa758143565a53dc4f7f4668a44f2add3cfc_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:aa9e53a4084bd82759e905496dd8a82ac599aab54ad5fd0223ae0edf896cc2f1_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:f6c76892bd295525c81a76ebf330fc443a5272e96fa205f245dc09fea3bb3a6e_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:2eb4621f7c2ce4f9baaa11f84bde12e6a1e9ff411cc9067096d4b223c6efa13f_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:dac9c533beb0f4f63828c32a9ee3e539da3e522df93f6286174f69a958d5850f_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:e5dd1f388f38568cf78441c98d021c84439c3bc1b79f80cb847bc1090f301ad9_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-operator-bundle@sha256:ae86173c23eac013721cdd47405b357fdb9fa6266fd3342aa38e209f3ca75610_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:345310ef483f733801382c9f27a535013442f3f463cc608c55260091adec7c88_arm64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:34b7cd46610925195fb0266145e67e04c75b50f0510089123b8462c641cc52bd_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:47bb815cc50ef53397139f20bd7c751379c346c48ad18ea8f7d0269f269fcae5_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:9b82236d7411da4cbfaa8f7a7420c42ad6da9a3e0c39326293906049e3c97be7_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/odf-cli-rhel9@sha256:0dbb2424ae6708e11e7a2068f942ae571ffae456f71a4ad80d3784264e9ef011_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/odf-cli-rhel9@sha256:7ec467afc6a1f192ea58db8c20f21361f5538eadc3f75f057cddfada80e362d2_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • +46 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.16/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (17)