RHSA-2026:92994HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.21.41 bug fix and security update

Published
November 3, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (3)

CVE-2026-33814 →CVE-2026-39825 →CVE-2026-63209 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39825 — net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:2f38cec2bd41a9613430953b721fe02e168d21840f4d2eca751817483ef4f0f3_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:584ae4b36dad67d1d75e5d10022751aa1bad64b199cb494fe5584ed3baaa7cd5_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:8b85868261f01ed12c62757bd31d0e3739f5175c9a823a823daa92a14e6ab191_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:be8e002caab42a7262614050530595083c4d96f5c672464c57caa3886c8c6921_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:32985dcb73839200b41c29ec7130ecf2b8f38331eca1897a20e3a04c37824861_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:b3b6701167559b50e5367f0f95a97cad29833b07dcf57e74aeb0ef4b80f1c495_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:bca377901884d8bbb355a26a76dbd9fd62dc110364264112d091506847307337_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:c6ef7d7fc5239adc786b4fd0acccc41d927e52052ceda6ed00c448e5d995c199_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:605e4c1878ec02c4642dbb3c4322c422be7812c7a87736fde7d1432b0aa6044c_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:826b6fd22980818063e8b83c4caf97a6dae1d2594eed7575d59629ff81ac2725_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:85d14131ef5813b9437452d5b4b3449af385eab6a31a17ee5ad82c7040459358_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:f86b53c14f06ee3cd8ab6615fe97ff1f689ccb3a0a2b3e11bf6a39f0b6509da6_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:0e317c840503996381dfd5bca5550964c8492bf4e60c7b14f5f478b3dbf68b88_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:30337301a188cc97f024ae17193f2a37f12e54367db64493ea383cafeed1b098_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:9e88352cc9dc7081ea9a1f4dadfcd6653444c3c91f040943f40b7827af534a82_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:f366467e40218f64026d6e7fa682b58929a1c13b414e09abea6d17a73ab73b56_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:14ad73c57121978d2e65016a6dcc0483ca7e93cc18b0c69f2af0088210bc8b6c_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:8890d1bb108f867f66f9d0c9983ea3d85161889d9f22567721db7060ae5ab2e4_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b8266827ddfa4101c403966603e46cf1236b180e0566c2794e4306cb2a03b542_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:be1b7cb00817e3bd4a47681482e7c9fe2e0a05df9b0369dc0d1cacfb0d690692_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:4f2943878feeb8b0c534136417f4dc3b9f8163e6ea3d0eae32378cfcbf025660_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5ce3dad21124902e0c0fd39e7079e43d5b5cb5d3d3e7ed5ae5a9ea89cc0d5c3a_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:9f3047d9a3e58760318dae458a85b6a53fa3884fa58c0f8f7582bffaf3354058_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:a935c268342fb94f128128ed7ae9570d7d7347cdd373ef201a8223c113afa49f_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:1965bb197489989976d4b8bab68deaca94bf7c53575c938797ec60481eb3ed65_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:620457ad33700c7a260cc7ed3806aeb2cbc124a4c764f97f66a0d70f68d62023_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:d31debfe455df8dd74e28a994c788528c309c3e21d1b0bfece60450a36e0b025_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ee34bec1affc22d52458fdc2db3a144dde2291c939a95020af29da36a18824b2_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:2fa14c0dfb2da7b94497b808c1129a6b016d3347fd1485e5e7404caaa4537663_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:bcbc7f31b5ff1849bad7fd0b11a8d0a22e1ae2a2879a51bf25e1fd7a2b266605 (For s390x architecture) The image digest is sha256:cd0bee20d3720c3608958c4b22c7c8755bd4d2496ab3100408a01a0cef06f552 (For ppc64le architecture) The image digest is sha256:608c439034bfce20f9d183e4e483a7c8be1f5d511c45c6cfeabdba72e1df6d71 (For aarch64 architecture) The image digest is sha256:a6a18ddf220637e1c10df6fe8782d7d9b75265cdc1eb8ab1eb2adc30cf1eaa38 All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy's Rewrite or Director function for security filtering.

🔗 References (6)