Red Hat Security Advisory

RHSA-2026:89341

OpenShift Container Platform 4.20.44 bug fix and security update

Released 2026-10-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47

Fixes 7 records

TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

MEDIUM 47

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01834 Published 2026-05-22 Partial fix · 1.25.13, 1.26.6 +2 CWE-1289

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248

TI-2026-26186 CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

MEDIUM 40

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2026-05-07 Partial fix · 0.53.0, 1.25.10 +1 CWE-835

TI-2026-73968 CVE-2026-104795 · GHSA-98f3-7g2j-289q

Container escape in insights-runtime-extractor via privileged exec

LOW 39

The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00183 Published 2026-10-14 Partial fix · 1792771524, 1792849665 +2 CWE-250

TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2

Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

LOW 39

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00473 Published 2026-05-22 Partial fix · 0.52.0 CWE-704

TI-2026-78632 CVE-2026-111943

Go crypto/x509 accepts known compromised intermediate certificates

LOW 32

On most platforms, Go uses the given system root certificates.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00396 Published 2026-10-21 Partial fix · 1.26.10, 1.27.3 CWE-299

TI-2026-69284 CVE-2026-107176 · GHSA-f5p7-fm92-q7hr

Excess secret read access in OpenShift cluster-samples-operator role

LOW 30

A flaw was found in the cluster-samples-operator.

CVSS 3.1MEDIUM 6.8 Adjacent network Low privileges No interaction EPSS 0.00275 Published 2026-10-07 Partial fix · 1793123280, 1792826398 +2 CWE-250