RHSA-2026:83627HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.40 security, enhancement & bug fix update

Published
October 15, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (5)

CVE-2023-45288 →CVE-2025-61726 →CVE-2026-33186 →CVE-2026-33814 →CVE-2026-34986 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products73

  • Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:76d612ee774ea4d9fda90d1e7e58e6606916ed530b0922a0573410e681602478_ppc64le as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:bc92f89a4bcdeca89378ad554ab199ab358d862cd189eafdf1ad10077483246c_s390x as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:c5b75fb8b0201c0c6b93a05242044e15a479362df8a273fd137ec648d42289b8_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-cli-rhel9@sha256:5e70220bd4d047638eb96107b3d584351f66162553f957525a73c43f279c1560_ppc64le as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-cli-rhel9@sha256:66746563adce4d908afb3fbdfa9b299d2e8460754d86a8a8896ee827aa7b1c4c_arm64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-cli-rhel9@sha256:e181990ab606663f23be09fcadc9f4dd50ff26d34b11f33a67959c343ff18898_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-cli-rhel9@sha256:f5fb837cd9bc6f069decc3474e55b31e00f6e26d720addbaeba973ba5d29e212_s390x as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:2f24282cc8e04403206ee26b231387ed88f81d0bd6c45c44442a19effb007631_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:f06db69a8343c89c8880099ba9af6a2c1bb23405eb7be69d1e95b6992bf3c0f7_s390x as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:f09d3cc206287669b25dd538d4ab81911dd9a7de66e3546d2221d992edc34e13_ppc64le as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:87ed190a2d697693cee5c44fc1e72de4b54ed07e872b9bce6993936acb7c34ca_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:0b7cf5d85d01612a1540888201f078143ee1549c58a644271d8e886d134398be_ppc64le as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:3d28260976f0c420a3a3943575db5a6d7f879b7604b12123618c5d55f3433083_s390x as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:8eafd5625f76e1f5cec4ac8bd90d9ebd5b054b7a02a30efc973660ccb0b98ea2_arm64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:9461ba3f20cc78ee3eb6d882ef300e8e4f8c1f228c95f49b39f0a1bbfb6034f9_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:5665454817123a17a119db6fcec0cf337ade254e773aec2637b3496e35008acd_ppc64le as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:9cbb6b6452d1af7e615fd5a835e03cb5736dd6c4101592d560aae531142bb513_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:c7bdbcfc8919f5cd7dbf519fbbd5fd8468e58070ec71c0ef1fa9dc6bfa47513f_s390x as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:ff536edcf9a285b653e1e6491f37a08c50869e633da61d77de15befc2e037e18_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:87af30fbe4372541ad6949fe95ab0e2cd5a7cc8c68cad7f7af5ae157d0250e9e_ppc64le as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:a285990ea3f96c8647c273b8e4b9860db850816dc59c5956a314dda29301421b_arm64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:bc39d090c88f1d561ca71a931e0be506f1cb1e1d5f0ac939dd4fb4c2a3951c6b_s390x as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:c1b7cb11726694694b6e5b252eb2aa391ab525de23fb2eec7892fbe6c2b837db_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:082505668051fb7baa76a83826b02e7bf92d0173d6df0c161b9470aa299a27df_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:2ed618a2de69e6c17d358923a3e62d31d2b24cc247c923a2d77161d047a0f076_s390x as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:42dbe696a3529a89220a820976bbe4e06d070ff1f36664549812eb3e5e93bc85_ppc64le as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-operator-bundle@sha256:bf28f3bbd1cd9969d6c544e68c7ddd49f48a273441fe14d3e0f0e0673af31207_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:2322abcbbb1881694580b1fe24728c19fee2573ef90e1af85ec9c4d63b1b8b2f_ppc64le as a component of Red Hat Openshift Data Foundation 4.14
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:6851430684ec641c6a5e5ef258ea4baf51a13710f35d3aa9614ec1aa94d7266c_amd64 as a component of Red Hat Openshift Data Foundation 4.14
  • +43 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.14/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)