RHSA-2026:79154HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.22.18 bug fix and security update

Published
October 19, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (3)

CVE-2026-33186 →CVE-2026-33814 →CVE-2026-46597 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:17016afd164462a536c1f986d32a42c34571572a24d6f10e1956ec619020c220_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:491c69f04faf34c42e6423906adc045ab5a284f52d9cf763b1defa4930655388_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:548794fdae1c939d8079dacde318d98520fff8e49338990bff6a01207f65c309_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:f7adada82506685029ba314f92af1fcb77331e6ed50d1d836160d360e799f57c_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:26445ff5f710b7f3f88729de614cd37be84bdd3432775982c4ee907858502bf6_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:3cf18318ebfcd734e2e050938ac692193aae4d4a09e0becbdc961b44c47f835f_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:3cfaf6f51a490118d795ce2c4066a421841214952e642347166236053ed7088a_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:54c5f13ff23fc4bfa68549b4e2d37bfa4d56c98ea1c7ea2001a13c015c8b107d_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:c4cb1acda6b37efc3fa29f0f573a9e418d0cb12de36deb6ed4fd38053f13796b_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:e3bde60cc099a1304dcc2b0b06d25306ee2809c3b2012e00671e5ad4440116cb_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:eca6f2643278f27b229a682d38acd84b3cede6baafeb6aaa7f9f3ef32cf9c6bc_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:fe4a4593c3729c13f5143badac1787d6bb20d0b8fedb8f1a890a6068cc31d35e_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:2053f9dc431ac7d9ed5fd16c9dd7686e40eee8eab11f15cae23950e7fae1c240_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:509528637ec03931eabe870f1c522667272f57aedcd159a0f52f7b058571ffc6_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:834c930a57501ce12d5e56461fb9b0a3f553e316c60229a3030a9898bc2b392c_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:b9136a5e78e3396a03324d903de8a868da0bbe101a6b867862bf37fdae072c43_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:443ebb48bb5cc0a3aeb895e17f6e4080207e6eef7ccf757e3942399e92c7af69_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:5b7168add8817546e6e25e4b0ef1b62b77bc9b23d215197ffd8e9e59d305f0ab_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:69bec89a4fcd48992c23fae81cd45decaf586def537f8d2274eb2f79b0d06dac_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:b332cd90536827f9c1875344365a67a59f58bd1d33f78a239bf1323c72f2e42f_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:0f2d4cb018d90a2ab3b9b9168399a556b9cb64d2552bb978738b912fc74a3863_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:3e34d8bdca5790c32b978f179c1320891784a918a0d6637f92100aa69f4cc3c2_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5e1948df74352d07899d71b684daf4175e188e45314d5cb9abdde1f1fbfdf0fe_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:d704a9f7147a077479c8dea2d4621255217d9aa5528643fbefb390eb09b704b2_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:1f748c611f0fee9293d1f9768c81391f3c3806526b5a307fbbfc0666036289e2_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:2ff43706e993fcdcb061876e1f67eb26a226f45e7690b28e652d3e9056ef006a_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:a3f5635ebcb443510f1d3c906b2843f42ca18fd56d232129fd26c2450606742b_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:f6b5f6204b3cc5cbcc381b487d82645c03545446221769ff2eba595b7cb28936_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:442805fe2d7f8e2bb64d273a22ac2e58fc1cb929d03c7502d5c0cd74f99f7d06_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:909845d984190b49c97182be33f3919446fa2bdb44fd362046e45a98c55f3c53 (For s390x architecture) The image digest is sha256:fc7b112435fac010ef165183eff3e5780abac2f2e8c86f9a67461bcc662722c4 (For ppc64le architecture) The image digest is sha256:ebd1b2b30482fe7da3f8896064a9eeb181a7a2da8b72c7bd55c7ac61b0843045 (For aarch64 architecture) The image digest is sha256:9a371f67a3b0ba3ea01d2107965124f4584680b1cdddc19520ca8983a3113d1c All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (6)