TI-2026-27599 CVE-2026-35469 · GHSA-pc3f-x583-g7j2
SpdyStream: DOS on CRI
Priority MEDIUM 45
spdystream is a Go library for multiplexing streams over SPDY connections.
RHSA-2026:83502
OpenShift Container Platform 4.20.43 bug fix and security update
Released 2026-10-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-version-rhel9-operator +13
Fixes 6 records
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-57933 CVE-2026-84292 · GHSA-qw65-cvwx-89v3
fast-uri vulnerable to authority injection via an unvalidated port in serialize
Priority LOW 38
fast-uri serializes the port component of a URI without validating it.
TI-2026-71187 CVE-2026-75888 · GHSA-gh23-889q-gfpm
Server-side request forgery in OpenShift console via Helm chart URL
Priority LOW 34
A flaw was found in the OpenShift console.
TI-2026-69469 CVE-2026-93017 · GHSA-97xr-6xrj-3f39
Insights operator gather service account can read all cluster secrets
Priority LOW 34
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every na…