RHSA-2026:89626HighCVSS 8.2

Red Hat Security Advisory: OpenShift Container Platform 4.21.40 bug fix and security update

Published
October 26, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (5)

CVE-2026-39821 →CVE-2026-39829 →CVE-2026-107176 →CVE-2026-111943 →CVE-2026-33814 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-107176 — cluster-samples-operator: Role reads ALL secrets in openshift-config, not just pull-secret CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:1ad56c06803f7d77dee1527220511115cbd5eab1afb259fd82995c73f30ae7ca_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:94162bbefa28543be87cd76b44a99b60eb2ed745c6ef21f215c3b59f24a35670_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:c70052c207756d65f781c03a66f0fb4365d8bacc551b1d6e6f20af433597e7b4_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:d8180002fb179e3c3aafbe8b23d2d48283995f40f7a5c7c3ea385dceedbf9ed3_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:4994aa0280af533eb819f98a5b18bfae7dd3f53390fb117ea0c72582e86e353b_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:7c72119960247b07bd6a116943f3b7f2748065af6a2bb9482614118b687bfa78_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:a96eab6b9cb1710d5ba770860c0f6167a38840e79a6693d01ae81e81b7aeaf3b_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:c81103a7f874eb50e4945905d29eaddc4bb2d47e5c4ae0c0d558ec8465fd49cc_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:716dec1674fae9feba6fdd178012a597fd96ba5e090b371099d037573579bbf0_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:8bda05af3c8ceb6971187864e1028d53c0694958f2d3df2434c79aae4d7591cb_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:9d0f70e4b90d80302692bd5976c078cabcf431f3b942a77ecc1f822873fb66a2_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:fdd80ac147e58f0c7d70d5546d9cdd380aa6733786b7e4a6fafe0656461563c2_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:0a608f37ee537925b3c9d57c12a4b9c995255492ae159541dcf9067634f840fb_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:19400b9a8c855803681c9bf5932056475be8ab62d1c2e19be576dbf69de80f35_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:ac1af3ecdea43577fcd3f5d52b70150eb0c3a967b1406699a9b45b88c0f2898c_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:b2841b765030fd9a10b1a732612ae0d127b5dd09112657b301afc38d5620932d_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:546a6ca084bdadab861b10308d9c60a21cf65a7a0925233f24b9e9e6ca2a6c02_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:6d26e2ba07a3f131fc0498cc0de4da5fc7cf7788fb354053bb10db3167d8e97c_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:e982aca66aa798fead8e8b8a860201846818c3a8596b10ea8c314cacaf5cccfe_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f9c1b14bfc4e4637df66ac64851003705b22da00cf91f00e8389cb6e541797e5_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:2425c7803d492055e695c10d853c7cbf1359f0e1356e4d07e658b48766c017d2_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:2b29d242ed394807d9ee84fca80107626288c591c25a05612bd34895057572c3_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5c912bae1762065fa0da8104ccc240d1818027120f9460ec9c682778c0065b42_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5cf63723127dd8bc6d0e1bd28b1f772b1aa34149c82cce8ee93d12799e862bab_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:385f2949db5e61924035e6ab6fe4bdeecbc8a3e163b366fbcec3c787e40e4eef_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:832658c216e985db42600acb716401d123e31c10aaaaa3037f96e477ca684651_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:87132b0407cf30887711a3897ee5b0b195fede95fe8e420dac01bf10a6d41bfc_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e881923fbe6a73b039835c3f9bd41a472ef97631a997efc89ed9a3bdaeb1aede_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:40a43494fa7f15b68b0080c7ce8e3e414e05b63426eb9e7064521f699ddd81cd_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d (For s390x architecture) The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059 (For ppc64le architecture) The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd (For aarch64 architecture) The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02 All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (8)