Red Hat Security Advisory

RHSA-2026:57361

OpenShift Container Platform 4.22.11 packages and security update

Released 2026-08-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.22 cri-o-1.35.6-5.rhaos4.22.git41f610b.el9, cri-tools-1.35.0-3.el9, openshift-4.22.0-202608190726.p2.g05744ab.assembly.stream.el8 +17

Fixes 3 records

TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9

Quadratic complexity in WordDecoder.DecodeHeader in mime

MEDIUM 40

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0056 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4 CWE-407

TI-2026-28704 CVE-2026-39822 · GHSA-xcgv-8mv7-v8c7

Root escape via symlink plus trailing slash in os

LOW 36

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00232 Published 2026-07-08 Partial fix · 1.25.12, 1.26.5 +1 CWE-61

TI-2026-13297 CVE-2026-15809 · GHSA-9gq4-2485-q63q

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

LOW 35

A flaw was found in CRI-O.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00183 Published 2026-07-15 Partial fix · 1.25.5-36.rhaos4.12.git2e7f657.el8, 1.26.5-32.rhaos4.13.git1088e36.el8 +9 CWE-134