Red Hat Security Advisory

RHSA-2026:68546

OpenShift Container Platform 4.21.34 bug fix and security update

Released 2026-09-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +14

Fixes 3 records

TI-2026-39884 CVE-2026-55204 · GHSA-4vj2-5mvx-3vcc

HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

MEDIUM 44

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00484 Published 2026-06-18 Partial fix CWE-476

TI-2026-26186 CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

MEDIUM 40

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2026-05-07 Partial fix · 0.53.0, 1.25.10 +1 CWE-835

TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021