Read the docs
TI-2026-27599 Aliases CVE-2026-35469GHSA-pc3f-x583-g7j2

SpdyStream: DOS on CRI

Priority MEDIUM 45CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 36 fixed, 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00656 51st percentileScored 2026-11-07
Fix Partial spdystream (moby): 0.5.1github.com/moby/spdystream (Go): 0.5.1Red Hat: 89 advisoriesRed Hat: 36 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mobyspdystreambefore 0.5.10.5.1Patch availableCNA
—github.com/moby/spdystream (Go)before 0.5.10.5.1Patch availableGHSA-pc3f-x583-g7j2
  • spdystream Vendormoby Affected before 0.5.1 Fixed in 0.5.1 Patch available CNA
  • github.com/moby/spdystream (Go) Vendor— Affected before 0.5.1 Fixed in 0.5.1 Patch available GHSA-pc3f-x583-g7j2

Remediation

  • Fix · CNA spdystream (moby) Fixed in 0.5.1
  • Fix · GHSA-pc3f-x583-g7j2 github.com/moby/spdystream (Go) Fixed in 0.5.1 Advisory →

Red Hat 89 advisories

  • RHSA-2026:92283 Released 2026-11-03 · Red Hat rating Important
    OpenShift Container Platform 4.20.45 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/cloud-network-config-controller-rhel9, registry.redhat.io/openshift4/ose-baremetal-machine-controllers-rhel9, registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator +3
  • RHSA-2026:83502 Released 2026-10-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.43 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-version-rhel9-operator +13
  • RHSA-2026:83013 Released 2026-10-14 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.17
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
Show 86 more Red Hat advisories
  • RHSA-2026:70870 Released 2026-09-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.3
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:68349 Released 2026-09-16 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.2.13
    • Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
  • RHSA-2026:66521 Released 2026-09-10 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.1
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
  • RHSA-2026:63046 Released 2026-09-08 · Red Hat rating Important
    OpenShift Container Platform 4.21.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9, registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9-operator +6
  • RHSA-2026:60023 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.17.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9 +20
  • RHSA-2026:61314 Released 2026-08-31 · Red Hat rating Important
    Cluster Observability Operator 1.5.2
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
  • RHSA-2026:59557 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.6 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +16
  • RHSA-2026:56431 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:51007 Released 2026-08-12 · Red Hat rating Important
    OpenShift Container Platform 4.19.42 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9, registry.redhat.io/openshift4/ose-oauth-proxy-rhel9, registry.redhat.io/openshift4/ose-ovn-kubernetes-rhel9
  • RHSA-2026:51013 Released 2026-08-12 · Red Hat rating Important
    OpenShift Container Platform 4.18.52 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-oauth-proxy-rhel9, registry.redhat.io/openshift4/ose-ovn-kubernetes-rhel9
  • RHSA-2026:51422 Released 2026-08-12 · Red Hat rating Important
    Red Hat build of MicroShift 4.19.42 security update
    • Red Hat OpenShift Container Platform 4.19 microshift-4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9, microshift-ai-model-serving-4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9, microshift-ai-model-serving-release-info-4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9 +12
  • RHSA-2026:53655 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.13 Images
    • Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9, registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:51022 Released 2026-08-11 · Red Hat rating Important
    OpenShift Container Platform 4.20.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-oauth-proxy-rhel9, registry.redhat.io/openshift4/ose-ovn-kubernetes-rhel9
  • RHSA-2026:47728 Released 2026-08-06 · Red Hat rating Critical
    OpenShift Container Platform 4.17.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9 +7
  • RHSA-2026:47729 Released 2026-08-06 · Red Hat rating Important
    OpenShift Container Platform 4.17.56 security and extras update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9
  • RHSA-2026:43227 Released 2026-07-30 · Red Hat rating Important
    OpenShift Container Platform 4.15.67 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel9, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel9 +4
  • RHSA-2026:43253 Released 2026-07-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8, registry.redhat.io/openshift4/ose-haproxy-router, registry.redhat.io/openshift4/ose-openshift-apiserver-rhel8
  • RHSA-2026:44267 Released 2026-07-28 · Red Hat rating Important
    OpenShift Container Platform 4.21.26 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +1
  • RHSA-2026:44237 Released 2026-07-28 · Red Hat rating Important
    OpenShift Container Platform 4.22.7 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +1
  • RHSA-2026:40030 Released 2026-07-23 · Red Hat rating Important
    OpenShift Container Platform 4.12.94 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8, registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel8, registry.redhat.io/openshift4/ose-openshift-apiserver-rhel8 +1
  • RHSA-2026:40022 Released 2026-07-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.69 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8, registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-haproxy-router +4
  • RHSA-2026:40023 Released 2026-07-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.69 security and extras update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-node-feature-discovery
  • RHSA-2026:40828 Released 2026-07-22 · Red Hat rating Important
    OpenShift Container Platform 4.18.49 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9, registry.redhat.io/openshift4/ose-haproxy-router-rhel9
  • RHSA-2026:41019 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
  • RHSA-2026:36621 Released 2026-07-16 · Red Hat rating Important
    OpenShift Container Platform 4.16.66 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:37581 Released 2026-07-15 · Red Hat rating Important
    OpenShift Container Platform 4.19.38 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9
  • RHSA-2026:37580 Released 2026-07-15 · Red Hat rating Important
    OpenShift Container Platform 4.19.38 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator, registry.redhat.io/openshift4/ose-haproxy-router-rhel9
  • RHSA-2026:37193 Released 2026-07-15 · Red Hat rating Important
    OpenShift Container Platform 4.18.48 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9
  • RHSA-2026:37629 Released 2026-07-14 · Red Hat rating Important
    OpenShift Container Platform 4.20.29 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9
  • RHSA-2026:37187 Released 2026-07-14 · Red Hat rating Important
    OpenShift Container Platform 4.21.24 security and extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9
  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
  • RHSA-2026:34755 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.19.37 packages and security update
    • Red Hat OpenShift Container Platform 4.19 openshift-4.19.0-202606301915.p2.g63adf01.assembly.stream.el9, openshift-hyperkube-4.19.0-202606301915.p2.g63adf01.assembly.stream.el9, openshift-kube-apiserver-4.19.0-202606301915.p2.g63adf01.assembly.stream.el9 +3
  • RHSA-2026:34099 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:34050 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.12.93 security and extras update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-node-feature-discovery
  • RHSA-2026:34100 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.55 security and extras update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9 +6
  • RHSA-2026:36796 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
  • RHSA-2026:34766 Released 2026-07-08 · Red Hat rating Important
    OpenShift Container Platform 4.19.37 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:34791 Released 2026-07-07 · Red Hat rating Important
    OpenShift Container Platform 4.20.28 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9
  • RHSA-2026:34769 Released 2026-07-07 · Red Hat rating Important
    OpenShift Container Platform 4.21.23 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-multus-cni-microshift-rhel9
  • RHSA-2026:34794 Released 2026-07-07 · Red Hat rating Important
    OpenShift Container Platform 4.22.4 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:36162 Released 2026-07-07 · Red Hat rating Important
    OpenShift Virtualization v4.15 Images
    • Red Hat Container Native Virtualization 4.15 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9
  • RHSA-2026:29865 Released 2026-07-01 · Red Hat rating Important
    OpenShift Container Platform 4.19.36 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9
  • RHSA-2026:29857 Released 2026-07-01 · Red Hat rating Important
    OpenShift Container Platform 4.18.46 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-openshift-apiserver-rhel9
  • RHSA-2026:29858 Released 2026-07-01 · Red Hat rating Important
    OpenShift Container Platform 4.18.46 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9
  • RHSA-2026:29795 Released 2026-06-30 · Red Hat rating Important
    OpenShift Container Platform 4.22.3 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:29801 Released 2026-06-30 · Red Hat rating Important
    OpenShift Container Platform 4.20.27 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9
  • RHSA-2026:29835 Released 2026-06-30 · Red Hat rating Important
    OpenShift Container Platform 4.21.22 security and extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9
  • RHSA-2026:33078 Released 2026-06-29 · Red Hat rating Important
    OpenShift Virtualization v4.16 Images
    • Red Hat Container Native Virtualization 4.16 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9
  • RHSA-2026:33071 Released 2026-06-29 · Red Hat rating Important
    OpenShift Virtualization v4.17 Images
    • Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9
  • RHSA-2026:27004 Released 2026-06-24 · Red Hat rating Important
    OpenShift Container Platform 4.19.35 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel9, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +2
  • RHSA-2026:27063 Released 2026-06-23 · Red Hat rating Important
    OpenShift Container Platform 4.20.26 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +3
  • RHSA-2026:27010 Released 2026-06-23 · Red Hat rating Important
    OpenShift Container Platform 4.22.2 security and extras update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9
  • RHSA-2026:27983 Released 2026-06-22 · Red Hat rating Important
    OpenShift Virtualization v4.20 Images
    • Red Hat Container Native Virtualization 4.20 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9
  • RHSA-2026:27941 Released 2026-06-22 · Red Hat rating Important
    OpenShift Virtualization v4.22 Images
    • Red Hat Container Native Virtualization 4.22 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9
  • RHSA-2026:27914 Released 2026-06-22 · Red Hat rating Important
    OpenShift Virtualization v4.19 Images
    • Red Hat Container Native Virtualization 4.19 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9
  • RHSA-2026:27903 Released 2026-06-22 · Red Hat rating Important
    OpenShift Virtualization v4.21 Images
    • Red Hat Container Native Virtualization 4.21 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9
  • RHSA-2026:25046 Released 2026-06-17 · Red Hat rating Important
    OpenShift Container Platform 4.16.64 security and extras update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9, registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator, registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9
  • RHSA-2026:25201 Released 2026-06-17 · Red Hat rating Important
    OpenShift Container Platform 4.19.34 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator, registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel9, registry.redhat.io/openshift4/ose-openstack-cloud-controller-manager-rhel9 +1
  • RHSA-2026:25009 Released 2026-06-17 · Red Hat rating Important
    OpenShift Container Platform 4.14.67 security and extras update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-node-feature-discovery, registry.redhat.io/openshift4/ose-sriov-network-config-daemon, registry.redhat.io/openshift4/ose-sriov-network-operator +1
  • RHSA-2026:25187 Released 2026-06-16 · Red Hat rating Important
    OpenShift Container Platform 4.21.20 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel9, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel9 +4
  • RHSA-2026:25194 Released 2026-06-16 · Red Hat rating Important
    OpenShift Container Platform 4.20.25 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator +9
  • RHSA-2026:25207 Released 2026-06-16 · Red Hat rating Important
    OpenShift Container Platform 4.22.1 security and extras update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9
  • RHSA-2026:23235 Released 2026-06-11 · Red Hat rating Important
    OpenShift Container Platform 4.15.65 security and extras update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9, registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9, registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator +1
  • RHSA-2026:21697 Released 2026-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.12.91 security and extras update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-sriov-network-config-daemon, registry.redhat.io/openshift4/ose-sriov-network-operator, registry.redhat.io/openshift4/ose-sriov-network-webhook
  • RHSA-2026:21692 Released 2026-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.13.67 security and extras update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-sriov-network-config-daemon, registry.redhat.io/openshift4/ose-sriov-network-device-plugin, registry.redhat.io/openshift4/ose-sriov-network-operator +1
  • RHSA-2026:21658 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.18.43 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator +5
  • RHSA-2026:20089 Released 2026-05-29 · Red Hat rating Important
    OpenShift Container Platform 4.16.63 security and extras update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-dpu-cni-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9 +3
  • RHSA-2026:20041 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:20042 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-dpu-cni-rhel9 +5
  • RHSA-2026:20034 Released 2026-05-26 · Red Hat rating Important
    OpenShift Container Platform 4.21.17 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-api-rhel9 +15
  • RHSA-2026:17598 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.17.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:17599 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.17.54 security and extras update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9, registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9
  • RHSA-2026:17449 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.18.42 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9
  • RHSA-2026:17468 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.23 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/azure-service-rhel9-operator, registry.redhat.io/openshift4/kube-metrics-server-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +14
  • RHSA-2026:17469 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.23 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9
  • RHSA-2026:19108 Released 2026-05-19 · Red Hat rating Important
    Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.11.2
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9, registry.redhat.io/multicluster-engine/assisted-installer-rhel9, registry.redhat.io/multicluster-engine/assisted-service-9-rhel9
  • RHSA-2026:19099 Released 2026-05-19 · Red Hat rating Important
    Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.3
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9, registry.redhat.io/multicluster-engine/assisted-installer-rhel9, registry.redhat.io/multicluster-engine/assisted-service-9-rhel9
  • RHSA-2026:17475 Released 2026-05-19 · Red Hat rating Important
    OpenShift Container Platform 4.21.16 security and extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9
  • RHSA-2026:17704 Released 2026-05-14 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.7 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/multicloud-integrations-rhel9, registry.redhat.io/rhacm2/multicluster-operators-channel-rhel9
  • RHSA-2026:17123 Released 2026-05-13 · Red Hat rating Important
    Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.8.6
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9, registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9, registry.redhat.io/multicluster-engine/assisted-installer-rhel9 +1
  • RHSA-2026:17121 Released 2026-05-13 · Red Hat rating Important
    Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.8.6
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/assisted-service-8-rhel8
  • RHSA-2026:12118 Released 2026-05-06 · Red Hat rating Important
    OpenShift Container Platform 4.18.39 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
  • RHSA-2026:13829 Released 2026-05-05 · Red Hat rating Important
    RHACS 4.10.2 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:13791 Released 2026-05-05 · Red Hat rating Important
    RHACS 4.9.6 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:11217 Released 2026-04-27 · Red Hat rating Important
    RHACS 4.8.11 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2
  • RHSA-2026:11070 Released 2026-04-27 · Red Hat rating Important
    RHACS 4.8.11 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Dynamic Accelerator Slicer Operator for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift for Windows ContainersAffectedNo fix yet
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:61314
Logging Subsystem for Red Hat OpenShift 6.0Fixed RHSA-2026:83013
Logging Subsystem for Red Hat OpenShift 6.2Fixed RHSA-2026:68349
Logging Subsystem for Red Hat OpenShift 6.5Fixed RHSA-2026:70870
Logging Subsystem for Red Hat OpenShift 6.6Fixed RHSA-2026:66521
RHEM 1.0 for RHEL 9Fixed RHSA-2026:36796
RHEM 1.1 for RHEL 10Fixed RHSA-2026:41019
RHEM 1.1 for RHEL 9Fixed RHSA-2026:41019
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:17704
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:11070, RHSA-2026:11217
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:13791
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:13829
Red Hat Container Native Virtualization 4.13Fixed RHSA-2026:53655
Red Hat Container Native Virtualization 4.15Fixed RHSA-2026:36162
Red Hat Container Native Virtualization 4.16Fixed RHSA-2026:33078
Red Hat Container Native Virtualization 4.17Fixed RHSA-2026:33071
Red Hat Container Native Virtualization 4.19Fixed RHSA-2026:27914
Red Hat Container Native Virtualization 4.20Fixed RHSA-2026:27983
Red Hat Container Native Virtualization 4.21Fixed RHSA-2026:27903
Red Hat Container Native Virtualization 4.22Fixed RHSA-2026:27941
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:21697, RHSA-2026:34050, RHSA-2026:40030
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:21692, RHSA-2026:40022, RHSA-2026:40023
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:25009, RHSA-2026:43253
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:23235, RHSA-2026:43227
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:20089, RHSA-2026:25046, RHSA-2026:36621
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:17598, RHSA-2026:17599, RHSA-2026:34099, RHSA-2026:34100, RHSA-2026:47728, RHSA-2026:47729, RHSA-2026:60023
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:12118, RHSA-2026:17449, RHSA-2026:21658, RHSA-2026:29857, RHSA-2026:29858, RHSA-2026:37193, RHSA-2026:40828, RHSA-2026:51013
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:20041, RHSA-2026:20042, RHSA-2026:25201, RHSA-2026:27004, RHSA-2026:29865, RHSA-2026:34755, RHSA-2026:34766, RHSA-2026:37580, RHSA-2026:37581, RHSA-2026:51007, RHSA-2026:51422
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:17468, RHSA-2026:17469, RHSA-2026:25194, RHSA-2026:27063, RHSA-2026:29801, RHSA-2026:34791, RHSA-2026:37629, RHSA-2026:51022, RHSA-2026:83502, RHSA-2026:92283
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:17475, RHSA-2026:20034, RHSA-2026:25187, RHSA-2026:29835, RHSA-2026:34769, RHSA-2026:37187, RHSA-2026:44267, RHSA-2026:63046
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:25207, RHSA-2026:27010, RHSA-2026:29795, RHSA-2026:34794, RHSA-2026:44237
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:56431
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:19099, RHSA-2026:59557
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:19108
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:17121, RHSA-2026:17123
Not affected: 45 products
  • Cluster Observability Operator 1.5
  • External Secrets Operator for Red Hat OpenShift
  • Logging Subsystem for Red Hat OpenShift 6.0
  • Logging Subsystem for Red Hat OpenShift 6.2
  • Logging Subsystem for Red Hat OpenShift 6.5
  • Logging Subsystem for Red Hat OpenShift 6.6
  • Logical Volume Manager Storage
  • Multicluster Engine for Kubernetes
  • RHEM 1.0 for RHEL 9
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Container Native Virtualization 4.13
  • Red Hat Container Native Virtualization 4.15
  • Red Hat Container Native Virtualization 4.16
  • Red Hat Container Native Virtualization 4.17
  • Red Hat Container Native Virtualization 4.19
  • Red Hat Container Native Virtualization 4.20
  • Red Hat Container Native Virtualization 4.21
  • Red Hat Container Native Virtualization 4.22
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.22
  • Zero Trust Workload Identity Manager
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35469
  2. 2026-10-03 Alias added: GHSA-pc3f-x583-g7j2
  3. 2026-10-15 Fix available: RHSA-2026:83013 · Red Hat
  4. 2026-10-16 Fix available: Logging Subsystem for Red Hat OpenShift 6.0 · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:83502 · Red Hat
  6. 2026-10-20 Affected versions changed · Red Hat
  7. 2026-11-03 Fix available: RHSA-2026:92283 · Red Hat
  8. 2026-11-03 Affected versions changed · Red Hat
  9. 2026-11-05 Fix available: Cluster Observability Operator 1.5, Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

References

Advisory 1

Other 4

  • TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
  • TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
  • TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
  • TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
  • TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
  • TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences