RHSA-2026:83703HighCVSS 7.8

Red Hat Security Advisory: OpenShift Container Platform 4.21.39 security and extras update

Published
October 20, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (7)

CVE-2026-33814 →CVE-2026-44431 →CVE-2026-44432 →CVE-2026-46597 →CVE-2026-84375 →CVE-2026-102278 →CVE-2026-11332 →

📋 Description

CVE-2026-11332 — ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-44431 — urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-44432 — urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns

🎯 Affected products171

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:0d03db2d4f40545360e7d72914be7fa059e74e95663a818a9c99dfb96223a56e_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:4bea9a9cc5477f28fe1dd9fc2cd7437f5cc18bae1462c391b6761a4ac7fb4b44_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:5e74e6420ba9099ae1887b312d52b926afd86cff5c96aac2d70e49fc68bc311f_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:8f6571e6bb85157b1142e69990d57d33e46ab543ce5d33f19183286dfdf79c03_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:6d391e41f7b7399c7faca38eaf98eb6ae4a04a42cffd239161a2e0e0ef1719b1_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:6db3c0a1c98626fee987ec86b5a3a93cafbb87454c49c7f9abfe273bdb01f38c_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:7e39e22aff02b64acbdf96ac1b94e2d50935c2fa0b8c337ba2853581e6ac20f5_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:89cc56effb6bc9d707769ac508f3f93c4c18f8e9bec9399d5d904ce954f45904_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:12a3f6620c82bc48cafc00a28e2b718d347898d08d2a426014806306dec57f36_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:7db4c1b8aa9f336e54a7a69bb1ea59cb913e25cb0df304b22562a417cb7fc502_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:bf48e2214b5dcc226889bfeaf2a0cfcc53e2aca78fda0ec7f19edc79732d5ffb_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:cf147588273e72306f5dad11b81d280b3f0ac2d50e97d188026961e5d3f4d461_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:12daca1096a6326e1c8fff97476d92470589e5b6585685993ebcff64e00bc5e5_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:3ee345e86a31e3291b3595ff013e1dfd98ff596359a2f540262dc93f436175b1_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:c99dd498126c4b239b6689aa85b34acb4ca6d8f01a003a4858ab23138fd562d1_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:f8fddc6fa6109c3d2e5fcadfc20d040df7898557e366e893b5507f654471b294_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:69b1cc05fda5228ac8d4402a617dda0e92da387e6e2bba0c2377e3497f60c0c0_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:70242e8bb222afe65ee1dd62005cfa67f54eb14b214dad571d67a5b4c092377c_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:79927e0a56c1e9221111109f95ac4ca337aa2cbe3d57dbaa88cde8333c678851_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:f26a3326e85bc0659572a65df477ad53e896afc13ee668d7765e6c97c5a6a512_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:51114b27aae71aaf33339dec3a0c2a9c20d6dcbb0ea4136ca89d63eb724e68cf_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:60a70c4446016af891e87d64d1dfd1ad84c72ee8382bf2a97c22eddd933e30da_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:67cb82048a2795dfa892cbf59e50f994e68c0f3f49c7d3e7c2e0f099e5bd51ff_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:a7ea050283d92e484d5f16ac12f0a75d9fc48b9369651ca7a732cb23d4fe5af1_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:69d8c6e0a4d97600c0018aa25c14ddbe3ec3f25f32cc336e0f0d728268224a4b_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:7ab22cdbd5c2845ff991ec5e0cf72105e6ad2ceb372cd5a64847d1bdc4480238_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:b0a544661f50ec8093092ca14d7185b047b030172aa0e59bf87332a073269295_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:f45d999156df986a9bfe96848ced8d7dd561e838956656c4bb168b4d02a2be00_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:1e6326643e8c008f5706c76cec25050a85e8f4e2aa807fe08992ce5f32f3b3a6_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • +141 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (10)