Red Hat Security Advisory

RHSA-2026:92994

OpenShift Container Platform 4.21.41 bug fix and security update

Released 2026-11-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47

Fixes 3 records

TI-2026-45095 CVE-2026-63209 · GHSA-259r-337f-4rfw

Integer Overflow or Wraparound and Out-of-bounds Write in compress

MEDIUM 40

compress provides various compression algorithms.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00572 Published 2026-09-29 Partial fix · 1.18.7 CWE-190

TI-2026-26186 CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

MEDIUM 40

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2026-05-07 Partial fix · 0.53.0, 1.25.10 +1 CWE-835

TI-2026-28707 CVE-2026-39825 · GHSA-h74g-238j-357m

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

LOW 30

ReverseProxy can forward queries containing parameters not visible to Rewrite functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0039 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3