Read the docs
Red Hat Security Advisory

RHSA-2026:70615

OpenShift Container Platform 4.18.56 bug fix and security update

Released 2026-10-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 8 records

TI-2026-11286 CVE-2026-13321 · GHSA-36gp-wrgh-j78w

DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

Priority MEDIUM 43

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00217 Published 2026-07-22 Partial fix CWE-346
TI-2026-05215 CVE-2026-5946 · GHSA-cqgq-ff3f-rj7r

Invalid handling of CLASS != IN

Priority MEDIUM 43

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01942 Published 2026-05-20 Partial fix CWE-125
TI-2026-02623 CVE-2026-3039 · GHSA-p65f-mhrm-vhrc

BIND 9 server memory exhaustion during GSS-API TKEY negotiation

Priority MEDIUM 41

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01086 Published 2026-05-20 Partial fix CWE-771
TI-2026-09780 CVE-2026-11331 · GHSA-8p39-mp4q-99c8

Potential wildcard CNAME RPZ policy bypass

Priority LOW 39

An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00428 Published 2026-07-22 Partial fix CWE-790