Red Hat Security Advisory: OpenShift Container Platform 4.12 CNF vRAN extras topology aware lifecycle manager update
🔗 CVE IDs covered (1)
📋 Description
CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🎯 Affected products5
- Red Hat OpenShift Container Platform 4.12
- registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:76b3c78c793d333a0bf17b99ed708643ba599a076eb7ce49cc0f0ea8ac3a5634_amd64 as a component of Red Hat OpenShift Container Platform 4.12
- registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:ecff748af0b3b3137563ccb60855630d436bd3ad66c58d03b5a3a6d71e9fcd27_amd64 as a component of Red Hat OpenShift Container Platform 4.12
- registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:722df337486d308a5ca617a02e81ec1103cd6c4f9fc196bf1b02ac29007d3f74_amd64 as a component of Red Hat OpenShift Container Platform 4.12
- registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:caabb3eb7e01786507f87246d73f639332fbe235b70f170ad8372be737c434e6_amd64 as a component of Red Hat OpenShift Container Platform 4.12
✅ Remediation
For OpenShift Container Platform 4.12, see the following documentation for important instructions about upgrading your cluster and applying this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes/ocp-4-12-release-notes Information about accessing this content is available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/updating_clusters/updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.