Red Hat Security Advisory

RHSA-2026:79320

OpenShift Container Platform 4.20.42 bug fix and security update

Released 2026-10-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/openstack-resource-controller-rhel9, registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9 +9

Fixes 2 records

TI-2026-26186 CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

MEDIUM 40

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2026-05-07 Partial fix · 0.53.0, 1.25.10 +1 CWE-835

TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021