Red Hat Security Advisory

RHSA-2026:89342

OpenShift Container Platform 4.20.44 security and extras update

Released 2026-10-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-support-log-gather-rhel9-operator

Fixes 2 records

TI-2026-26186 CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

MEDIUM 40

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2026-05-07 Partial fix · 0.53.0, 1.25.10 +1 CWE-835

TI-2026-65313 CVE-2026-102278 · GHSA-qhr7-859c-m2p7

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

LOW 39

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00491 Published 2026-09-28 Partial fix · 5.0.11, 3.0.8 +2 CWE-400