RHSA-2026:6564HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.20.18 bug fix and security update

Published
April 9, 2026
Last Modified
July 28, 2026

🔗 CVE IDs covered (6)

CVE-2025-61728 →CVE-2026-22028 →CVE-2026-25679 →CVE-2026-33186 →CVE-2025-58183 →CVE-2025-61726 →

📋 Description

CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2026-22028 — preact: Preact: Arbitrary script execution via JSON serialization protection bypass CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:14dcafafa4d942a58f2bd8f9575f8e0f93dd5b54579a666165547bb76199e77e_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:226bee3ae41e8f3835b991ea5f2b3aec620b0e741384a0c06e6b5acf68a2e16d_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:3e17f9e248e98c966d41ab9d88cbedd23cb8182024667ceb00398252069e9ed1_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:fc0a2f0ae15e9db793b727d653e39d5370eb1480ca89a6e388a9becbaa00053c_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:090cf234301888cfa1b5715acc6a3b41c71529fd4a2758326df6897ab79afbd1_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:5040e428251940f113b2fbb12792c2f39e091566b2f7bed86bc382979ede6521_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:98ef433417eb53d16a329d9b503db9fad36a069254e7d31b9e9233d62e41e88e_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ee36165cbe698f4da348121c1d1b47e3979dc1487e10ff6b5032902982b3282e_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:4e458093a77e942578ac4fd3fa6d14ebac33df4982acceb8f3232f61db5bd64d_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:d116400fc7a9270e83831471cec0a351c774f6eb5eefa28986942e3dc57fa7d9_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:f941f4238c7c0e4e0d5577c68b893453d4029517131fa94770ee6436d059d4ae_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:fcd57705fc93f6cf74f58764c9f229071932255eddb398c1d7fe7d0e18b18d60_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:04d83b13ba85d5c74695328ae48fc6fff0cabf77adfdac368f6ae3dc3ae9657c_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:1f5531d6ae06bd72e04b67dc04bbd77720ce7e6e3d94df9885d217bdf5a3f430_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:4b493d3c70b43e3d0b9ebae16a594f554548b6f0b368287c756cf54fdb2e243f_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:8b6f21e3f59d6e7b7a94ad29ab822a237a4829f62916eea26ae1ca2d4a091411_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:35cb81575c44c103d3d84d0fa1f8912980b8c13bb334b099edc558b5c45be843_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:6fd730af4dce3b130c320983d23334c095f1510ffe5ccfee387de54674a769d4_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f10c6ce7698bf185a3f439712a0f4d631aa221e17e535def9716f047db6da732_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f5b77be8fb15944a0d60a7673b5f1e839ea58e3bfb1ae6194ea6eaab811142c7_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:216ec439741acb6f8da9954b626403ab6c435c2f8e6f86adb8315f4a94c26368_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:53bba5c683612dd9ce94471f295104a12e64fa65c9754cb1a693b0f2ba4a5d31_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5acfe04caa894811a0cd9cbe0360562b2c69d2227c0c5d39822a81501bdc6db1_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d5b1b74ba0ce890a64de82ca000bd47443021f73f18380cb2798f52f199f9506_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0e03fb55f2ee2336e7910e4fd143c5174ec63d3606c0eb324fbe32a4ba2562e9_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0e16a4a2e860e2ae741473165f524b555b845d9a74d71735f54d36ed9e2833c9_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:4fa4e08e27c74b8b10017e8bdf10dd79f51c3de7c23adac3108006bf0e03d86c_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:cb9af9ccd482dab6586fdd3e32896a7a1afab4e4293ea73dd19b72806df6c9b1_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:49f95a77a49cbb3c65f0c676bd97141cf5b9817823237ef3d027727f555980d7_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:2dab927fd20984e247301b2483083b71f942a1f550f5d8a1db42897edc042e39 (For s390x architecture) The image digest is sha256:49f803e9e47070ebc2aae9ed3433c45c04d967e87175664d061b53d1c0d18b2c (For ppc64le architecture) The image digest is sha256:d3cf84b3adc2adc115da38debf360eaec1d5a7a27edf2b2108e7d58dd7124be8 (For aarch64 architecture) The image digest is sha256:0f7c6277a847229d3ac5ae4f3539cabf7487b0c6030c9e71e321303400439f13 All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (9)