RHSA-2026:8433HighCVSS 9.1

Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update

Published
April 16, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (7)

CVE-2025-52881 →CVE-2025-61726 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-4645 · pendingCVE-2026-25679 →CVE-2026-33186 →

📋 Description

CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-4645 — github.com/antchfx/xpath: xpath: Denial of Service via crafted Boolean XPath expressions CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products18

  • Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64 as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64 as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64 as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64 as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64 as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64 as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64 as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64 as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le as a component of Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64 as a component of Compliance Operator 1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this issue, restrict the processing of untrusted or unvalidated XPath expressions by applications which utilize the `github.com/antchfx/xpath` component. Implement input validation and sanitization for all XPath expressions originating from external or untrusted sources. If possible, configure applications to only process XPath expressions from trusted sources or disable features that allow arbitrary XPath expression evaluation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (10)