RHSA-2026:92283HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.20.45 bug fix and security update

Published
November 3, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (2)

CVE-2026-33814 →CVE-2026-35469 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:5b48e6737f111320a8d91a80870d731e3e3cf52f94bdfa6a1b4b0058ec9e2b0f_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:e3930fcf1caf85eccd904de273e93f1710aa151123be831bcb58be187f2f30cc_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:edce9933a95da5d76dbe2eea4d353a72107ccf0304f82aa24571e211a4c253b6_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:ee35b3d20a34168bdabdd0d95b283a24c900d798265e81f9be65d2ce4f410104_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:0a46949ce755108544f39b01e3acd7c514dfc0929d74abe05bf2a751028b5a37_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:a24c78c90be7efe7309b4464d46baf22bf5b1c3f191684d8fd60034c0d6d4e5f_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:f12d75705471ff77c2bab73906c699e23c9e936165833430b692af266b9ed903_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:fcb61d00387e1175ee061bf44360663107f0b11179b022130a413a42355cd73d_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:06d178c1048c8c573c31b220bdcf78b8599a22ca0208f4f438e60fd748a2b2b1_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:8426214201bbfcf17e10f2d9906cea7a3b88ea39c10be550d7907da3b032e70e_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:8cb2104d7c1c432da3ac786a3beee06c5c6ab0c37500a3dc98672218f36d39ea_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:f89fd6e065e1cafeb65a3d9c228bebde6475610cc76ae34df1ae2589237d95ab_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:138235d3ef59a628c2e9633521a51d2b78128519fb7e6454fc263db8c3de89a1_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:4704dee10f4e9a331fad217e42fc2a08d7cbfa8be4334bd0a2d4304a6f271048_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:af1d156e4c3daf1202e77d1721c7528cad57c59e967327e203cad5954bb77d9d_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:f104d4680ef5d9699a413073935e525de92d3adf34796979e4a9e0c14cc3adaa_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:12720b43a336f4c8197075b7b90a727f6435984338f4d25735ccbf670fd42c7a_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:256ddd8df9a63cc4cada5626dffc7e66c352687b2efb4b62ae83a654f2e8777f_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:61c4dc50b74139d73b958407d970246c373cda629827cb5469a46d10af153d6f_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:63e07b1810b950622c7d4a36990690d162345ca78b2cfc94a41428449080efab_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:6d784443fc527f65651a36a9ff7d99952be6bff8accd4ab26087ee0255c2b51e_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:96672f3c8b79c2fe5312ea12ba627700818f9ca8997fb98b9a1a454b0ae6f2cf_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d318b56d5f6e9a3a0a1aac915bf4aad79040e8207b45cdad52bb4d2a67062227_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d7d8c8990f8f3b8e57b489e9502ff42a9ec1e14f844b824d157bd15d3448d609_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0d1d8d88de69edbab26c7491a319f2cf10af90c07bfc563af06f0797690208f9_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:2f00fd4a7a4d1160516cb0d97143d31452f6bf6c380f82be6276eccd02369d37_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:92283ca89fc1e8103726e3bac544dda5e6f3b8681747e6919f3661be7ecd98c2_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e8400d810e157255d2e5f979b5adfa00f0ec9b093527d79540b8f9122c2a2e72_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:1522e7c3067153e1ba3d489add62e9c8047bfc94baccb7f4805b13caa8bf071b_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:2284b7d032a2bcc021cb277d6bde2d413b7adb1a1bee84b322e6db758da53939 (For s390x architecture) The image digest is sha256:ed90a459c3546ffbb368a7cf2bdfc8fe3127ddaf0b91053aeb3dcb1ed7c2524f (For ppc64le architecture) The image digest is sha256:9078c50b7e434deecb4c5065cb84230663c19cdd0777deb1ae10ba59c7057fe0 (For aarch64 architecture) The image digest is sha256:59c4a6c8c80c136174e920b8f426cd6e5de3fe1592ce35a9ec6401265b5b039e All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (5)