Read the docs
Red Hat Security Advisory

RHSA-2026:70586

OpenShift Container Platform 4.17.58 bug fix and security update

Released 2026-10-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 16 records

TI-2026-11286 CVE-2026-13321 · GHSA-36gp-wrgh-j78w

DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

Priority MEDIUM 43

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00217 Published 2026-07-22 Partial fix CWE-346
TI-2026-05215 CVE-2026-5946 · GHSA-cqgq-ff3f-rj7r

Invalid handling of CLASS != IN

Priority MEDIUM 43

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01942 Published 2026-05-20 Partial fix CWE-125
TI-2026-02623 CVE-2026-3039 · GHSA-p65f-mhrm-vhrc

BIND 9 server memory exhaustion during GSS-API TKEY negotiation

Priority MEDIUM 41

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01086 Published 2026-05-20 Partial fix CWE-771
TI-2026-09780 CVE-2026-11331 · GHSA-8p39-mp4q-99c8

Potential wildcard CNAME RPZ policy bypass

Priority LOW 39

An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00428 Published 2026-07-22 Partial fix CWE-790
TI-2026-10207 CVE-2026-11824 · GHSA-8g48-4wfm-7247

SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate

Priority LOW 38

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00182 Published 2026-06-09 Partial fix · 3.53.2 CWE-122
TI-2026-39261 CVE-2026-54369 · GHSA-53ch-pxc8-6g72

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Priority LOW 37

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to esc…

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00153 Published 2026-06-29 Partial fix · 2.4.0 CWE-59
TI-2026-10205 CVE-2026-11822 · GHSA-6qj8-gw6p-hc5p

SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek

Priority LOW 31

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00195 Published 2026-06-09 Partial fix · 3.53.2 CWE-125
TI-2026-01978 CVE-2026-2340 · GHSA-m6w2-p258-gxqp

Samba: vfs_worm does not block directory modification

Priority LOW 31

A flaw was found in Samba’s vfs_worm module.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00947 Published 2026-05-27 Partial fix · 4.23.5-109.el10_2, 4.21.3-114.el10_0.1 +22 CWE-280
TI-2026-09220 CVE-2026-10723 · GHSA-4fw4-hmvf-4www

Incorrect acceptance of NSEC3 records

Priority LOW 30

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00272 Published 2026-07-22 Partial fix CWE-347