Red Hat Security Advisory

RHSA-2026:92284

OpenShift Container Platform 4.20.45 security and extras update

Released 2026-11-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-ptp-rhel9-operator

Fixes 4 records

TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

MEDIUM 40

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.0068 Published 2026-05-13 Partial fix · 2.7.0 CWE-409

TI-2026-26186 CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

MEDIUM 40

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2026-05-07 Partial fix · 0.53.0, 1.25.10 +1 CWE-835

TI-2026-32372 CVE-2026-44431 · GHSA-qccp-gfcp-xxvc

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

LOW 36

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00331 Published 2026-05-13 Partial fix · 2.7.0 CWE-200

TI-2026-09781 CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

LOW 35

A flaw was found in ansible-core.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00222 Published 2026-06-05 Partial fix · 1:2.16.19-1.el8ap, 1:2.16.19-1.el9ap +33 CWE-88