Red Hat Security Advisory

RHSA-2026:0996

OpenShift Container Platform 4.14.61 bug fix and security update

Released 2026-01-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202601191325-0, rhcos-ppc64le-414.92.202601191325-0, rhcos-s390x-414.92.202601191325-0 +1

Fixes 6 records

TI-2025-27240 CVE-2025-40778 · GHSA-xmqp-6cj2-2hh3

Cache poisoning attacks with unsolicited RRs

HIGH 76

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00667 Published 2025-10-22 Fixed CWE-349

TI-2025-07941 CVE-2025-8677 · GHSA-924g-f9mr-cm6x

Resource exhaustion via malformed DNSKEY handling

MEDIUM 52

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10737 Published 2025-10-22 Fixed CWE-405

TI-2025-27242 CVE-2025-40780 · GHSA-j3w4-m6qj-vmm5

Cache poisoning due to weak PRNG

MEDIUM 44

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00466 Published 2025-10-22 Fixed CWE-341

TI-2025-05409 CVE-2025-5987 · GHSA-3pvj-q7qj-89fg

Libssh: invalid return code for chacha20 poly1305 with openssl backend

MEDIUM 41

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0173 Published 2025-07-07 Partial fix · 0.11.2, 0.11.1-5.el10_1 +13 CWE-393

TI-2025-36934 CVE-2025-59375 · GHSA-vjqp-pjp6-xcxx

Resource allocation without limits in libexpat

LOW 36

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0138 Published 2025-09-15 Partial fix · 2.7.2 CWE-770

TI-2025-08904 CVE-2025-9714 · GHSA-fmj5-rvmp-845r

Stack overflow in libxml2

LOW 27

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00159 Published 2025-09-10 Partial fix · 2.10.0, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3 +6 CWE-674