RHSA-2026:92280HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.19.54 bug fix and security update

Published
November 4, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (4)

CVE-2026-46597 →CVE-2026-107176 →CVE-2026-33814 →CVE-2026-39825 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39825 — net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-107176 — cluster-samples-operator: Role reads ALL secrets in openshift-config, not just pull-secret

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:0585ce89fd19426f28d94b8011c5ba2ff3dc3a1ae8c2b597a860bf47f3a44dfa_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:5b5140f835cc44d3ede1f9c8245e26d7288eebf5da97eb4fa16955ad05a53e33_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:69adf8730fb936658c8fe2aa3137891fea01f4a128aaeb80f192c9c69b0a155c_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:b22401bb6c684a6f1008a1418f24a47f84c5966c6f802836a209ee7029f5ed2f_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:64ebb732451c049ffbe853ad6e5a54557b07ba5da1d034645d021950b35c52c6_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:7f385ea7cb0061db31ff37b4cbac5664433793ef6f0f31ce310fa12e50651ec8_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:9c07e220517cf4c2f228ab2ab9435cb6a613b3cdbf6e9a19ba2f132c707fb69f_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:dbc2449e9fd1f35378d253e26f77c6e559b9fbbb58d04d301964363740e3d9ac_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:77c9dbebdf1e38430ab866ba04304e4e5f741a7ed0777c9b93ecc234dd95cc8f_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:79cc7051bc10559a46ba790ac1533878fc58b4e955c0149ae1efaa825885cdf6_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:b6ad2e0a29240ae739092aaa49d4d13237ba93f8e811eb3e6aa870ee5978bf1a_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:f2efa74442c8d008e8f739010adf16d123e5fd566fbd21dcc32de20a9266395c_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:6d66b4f7025281338fae398535da2a2eec41ed6ae018c7bc79b480ce9cabb7dd_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:8893f6368609da921ca4415583323f3e510c16fc234dcb40abadff81607cb137_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:dba9adf95204be027905b4767f1e1242b36c95358abbefe867b0204d7bdccc45_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:e42609b872b85fefc54032a3b47b899e140b1aba7d0a191e4ea8d099e33a50c7_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:2252f1190ae896e460f8add81d33b5365accabab57efd6ce6bc2f0db744840e6_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:7b1a882887283c8141ece82972b42e010d5c5c3eb7942570b50585aaab32e29e_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:eb6790495600dfb248ac93b7566f130db29eb54950600dd5cf0e17a575ffe7b3_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f61630c8f1a3627b99d9ac213a942f2d248868c4a872bbb5b13145de26a57d52_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:260a3271e4e4a983a987676ff89fbfcae1d189ce2817875e76d8492fad6d016e_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:2616eaafc060de7e5f0d98e853d9918a77a1cea1d1c27345134a9278065f88dd_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:3883a96125dd6504d64ead113354ae1a93aac7fa33f050d83ee9fc7033f6001d_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:765c8459bb92d0725fbef2b5cc92de28438e3fea2d0ad7a68947051e17b61912_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:1472934d82f9d4dd77f57ba09701716f4ab89f92c484aa41021eb341425cfd22_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:52975daf940dc3e359fb3c4f86f33e8592646b539b21766094df7186aea8fa16_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:5ffb7f93a0803f03eb70853283f429bf32dc69e2bba577cc047ef09b81fddc49_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:c1bad0d61ad7603fedc59b65248d7f4cc0148911aab6eeea0e4143b740dd4f00_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:2452881592008844ec6af4ace48a6b101925d5f361f87ba382a0c912b5175227_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:ada0009d49a7b013929e0a75dd7cd31b9babcafd93a7f3be05714e4c11854bfc (For s390x architecture) The image digest is sha256:2a3b204265124c5c85cd9ba5a76736bb3ba9e1bf3bf812fe23d1a7d05776b011 (For ppc64le architecture) The image digest is sha256:03a9a4c7b3bea8c32c8d295deee51fb9de2b5f68d8e72791655e0d17fad90e1a (For aarch64 architecture) The image digest is sha256:d9515dbd095828eea4533726e577fa0fd5801749e49880b667e4683d3ee99bab All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy's Rewrite or Director function for security filtering.

🔗 References (7)