RHSA-2026:89715HighCVSS 7.7

Red Hat Security Advisory: OpenShift Container Platform 4.16.74 bug fix and security update

Published
October 27, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (13)

CVE-2026-83589 →CVE-2026-111943 →CVE-2024-24786 →CVE-2026-33814 →CVE-2026-46597 →CVE-2026-84292 →CVE-2026-93017 →CVE-2026-14362 →CVE-2026-39829 →CVE-2026-42151 →CVE-2026-49329 →CVE-2026-59887 →CVE-2026-75888 →

📋 Description

CVE-2024-24786 — google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON CVE-2026-14362 — github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-49329 — openshift/oauth-server: openshift/oauth-server: Quadratic-time DoS via Accept-Language header underscore bypass on unauthenticated login endpoints CVE-2026-59887 — linkify-it: linkify-it: Denial of Service via crafted mailto: links CVE-2026-75888 — openshift/console: openshift/console: Authenticated SSRF via Helm chart URL fetch CVE-2026-83589 — oauth-proxy: Open Redirect via /\ and /\t Bypass in Post-Login Redirect CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-93017 — insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:178ba50fc9d0850e42de0ab9797a488b2342c1e835d03dbebe5c933fc0892765_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:45e262f459fa92194969b52df503e8e7904d027e3a230160b13a359057d937e2_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:46d5454c595d1138da3b30ab9856d154b071c548311437f4941441c4f32eadf7_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:95101f88872a203c172c1826e9d0c328d1aca46760d2827958c79aba14f72bd3_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:5c51f2ea1dce5cb9d548cd352fb0a6ed8e9c5f7cabaab66d7310ce5dd96f8e00_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:b4768e2e2863759e8a67cc3b0c4a50c421232c424807202135438d43183b9228_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:ca1d8613237852536013f313cb07f8f6c55743fb0b46d0021557cd954f0bfd35_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:f11f59b080c95bc742e23a2bece0b1c3901c3d87d8d656ffb32c81360b7d6d71_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:1f62a7519f4c0277ae14980764ca4b58d63f86b1eb821f64ab1e810218926fdd_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:410e73a01e9e612b8bd362e4b66962d59d1c418ba47bb7b005130c0a120cd7fe_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:94dba078790ab835e35414de1db774cd9ab584b5032f8dec81104d5410e7b413_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:de5a50b6cf7629e12421b699780e09be559f50005f20f9a27b68543e7df4d5e4_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:0afbf7a410029ef914b2c758f1fe8d3319e6b994d52c0c9abae470cf94df75c4_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:268a202c8b523e7fb25d6fa37462d8ca6df0e58e0caba9acb42a9ab2a007849f_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:3a2482c3b0a25bca162533c7ce1b1367359366cf21f3bbdebcc1450502ed102c_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:b3a1be04b5f057efc3a7bb42e597508aa905e4cc49e3ce4060cb4ccae22ff1f8_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:2e3adaf596d5b3c91ac0552b7355a44fb4484fca9a4e26b42462e920bfea0529_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:9f26932d084601d97653c2c3df87a8a60056a14c71a4663cef2a77c76d6ab7cd_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ba816f61fd5de5ebcf114cd2b32b3a2bebd79285ee897ce07f717a257f84c80d_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:dd5ec19e582af06d00c14b30dd57533cb04ea284d436faed7c7462ac092c89f4_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:4e97b3630d58a773a90bca2c207113fa70a37a2ff44f95469bbd50f5c2453c92_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:6fbe98306b16543f991f21b527e37689e5cabf2903f22d7dfdf753973f8eead5_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:77ba418420b4577ce68455694e5add3920d4781f6b89dc52669bad445b08cbb2_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:8270d2512eb45cf13d00e1960928e150ab17ea32c9fd7f31d874a77feb0730c9_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:0bb0ac6c60e7f18088d3ddd3d87203fba52a93cf8be132a08f8b1bd58569b583_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:19c4f642de3061018ea928a7ae69ffc30d424840a1fcba54764f24b0483e5cfb_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:1a92ee7e53fbe59eb437c7821130cde67b0e5d7a7521ebf8dd8741698f1baea1_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:cc26e3cc20b45312a97f6ad06dc07b774a4686f0b54a7b28c333bf19fbdc8843_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9@sha256:09c727611705f640d282de6602674fe9dee1db5e30943539f5eb4e19da6dc784_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:58c211bf5fa3664f25940bf74fd4f4456938fa7f2abcefef3fcd7bfcced6b226 (For s390x architecture) The image digest is sha256:607a20b5005168109bbfb354afbe81f670a1f9f3a17bcbb6abaa30901732e49b (For ppc64le architecture) The image digest is sha256:56516f7c82727f72522365591ea900d8140ef5f7369a5d953e8594cf330822fa (For aarch64 architecture) The image digest is sha256:18b7a1f3673ec4d7d8e8faf1c533007ad369c9652acf6a49737048b2704bc378 All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade github.com/hashicorp/memberlist to version 0.6.0 or later, which fixes the push/pull state handling issue. As a temporary mitigation, restrict network access to the gossip port (UDP/TCP, commonly 7946 or 9094) to trusted cluster members only, e.g. via network policy, firewall rules, or security groups, since the flaw requires network access to the gossip listener to trigger memory exhaustion. Workaround: Until an OpenShift update containing the vendor fix is available, place an external WAF or load balancer that terminates TLS in front of the OAuth endpoint. Configure it to reject requests with an Accept-Language header larger than 4 KiB or with more than 32 combined - and _ separators. Rate-limit unauthenticated requests to the OAuth login and error endpoints as an additional defense. The proxy must re-establish TLS to the existing OAuth route, preserve the OAuth hostname/SNI, and validate the backend certificate. Do not disable TLS verification or expose the OAuth service directly. If an external TLS-terminating control cannot be deployed, there is no supported OpenShift router-only mitigation while the OAuth route remains TLS passthrough. Restricting access to the OAuth endpoint to trusted networks can reduce exposure but may affect user access. Upgrade to the first OpenShift release containing the fix as soon as it is available. Workaround: Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (16)