RHSA-2026:89655HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.19.53 bug fix and security update

Published
October 26, 2026
Last Modified
November 4, 2026

🔗 CVE IDs covered (3)

CVE-2026-104795 →CVE-2026-111943 →CVE-2026-33814 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-104795 — insights-runtime-extractor: insights-runtime-extractor: Container Escape via Privileged Binary Execution CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:02b0382a72f5859df67fa4de6ce72b57a065a8dfe9925d6900eb5992baf991d7_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:13afea7a5eae399439a062c115d90d23860d83f3111ef57508aad37ecb4ff3a8_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:aad8c966f71293d228b3affa044cd5a971b40f7f07d0b34118b19770455fe84e_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:ad4911c049d6e4d9938171637a2376af16e615d2e008ebeaf915b84a3233bc5c_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:4ddcc824996042d468ce648663fd2a7933cbeb50725439bd3b90594cc5fc7567_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:8ccbf784b46cee74fa4dd44cada823698fda5b04b6d66559963737e2c6ff9e24_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:9244168798ba6c0f4a77ed6d49bd1b3d28b9049b9c1c0865a5cc28e6dcfc06aa_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:dbf2b77b8df5ff5bd595d43e96c9a2e8f709ceb0270d9e1965c35498df06686c_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:3ddd6645885b6dcc2aa55d65733a6bddf799fef6a8c04210a8d430c51f51750a_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:42aa171e1bff55d18a45b283293669c94f52320723eec89c2682da03066f1372_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:cc242c2ece5a67dae790fefd25f124b32e283f9f022943d740ec8453282f749a_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:ea5c8df0f0fc3c9cde4dd4ac07ec1b4d70745b7fb35c3168d3f73be716d9666e_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:10c02da46f9483a83ddf3d4bff856ff511e2956d62cc16c092ec9a7b013a4bba_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:11627ecdc5d5204b0bc036354a9d55f65f9134550333c8c5c2735ab782c18415_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:89d39ed41a90f5a12b1ef9a6896b39fbf2a94c94549b57aab2a658671a0cdb93_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:c7e6bffbbc3d0801c4a7f0005e4c58d888be845cfaf7a84ce614fb4e1b997fd0_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b6cf332c205daebe9b735cc3556d16f7f8f210a2a1b8e91b85376f441d543148_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:c436cbfc89fdf2a530fbba2d85e9d575640429a008ab7c5160e362cbe10732dc_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:e3acc4a4c95761d6a45da006d46047b4f8d0f66e32449084fd6441228e9286cb_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:fae42b8bad567f72590ef85cc1ebb322e5f2900c7fdaa39cfc95bc072f45edcc_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:6b86a745c7728c3fff14e02575d0c15f86128c508246e7610bba682bda54dad0_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:c2dd7f231f4131538dd224e1ac88ef8fff23c09d8d42f2206803b71902d9cf1c_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:e217058f3c0beb49aeb566800e860bbacd1febaa35dedb008682f59a8154f2f3_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:f6680cc88bcf776ec7608b599871a3f9c7b2a82103a807fea7e04ca13a07b7da_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:020d9ce3ddb3b53a2f81e72487e08db59f8ba130a0cc84dc6b77be7fe5e834ea_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:6465f0b9a81e258027e6b7a59df99f767134ab0e66a8c79109e034451e30747d_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:76a0cfca2cfa476e8ccfaec294807d909460b71c1f8d722c5166d59cbd7fd233_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:9bee3e5ac2cd09b8b3ace1ab0769ec4c7dc3a5cab479c1a0c8ac77004ec5efa1_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:0aaff261ad4ff1484a84790e836e90074f16f04c74ba1d76560e5ed983fdaeca_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:ceea7abb1ba4451655fafa0b68f575fe08027b9d31a2c69b2d11480252b8a2f9 (For s390x architecture) The image digest is sha256:a76703edb647e23266f6aef919f63595299cd2979bcdc30b1a62f2774740a740 (For ppc64le architecture) The image digest is sha256:88cfca5eb98a3bf4adba10c69737ece75247e846e307640a042e35e192f13bb5 (For aarch64 architecture) The image digest is sha256:81b132a1d69bd3f2c3519a9b55d70ca932a2a014ec7e798f1ea8313fe0d31a3a All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: The vulnerability requires a code fix to implement a complete privilege drop (setting all three UID/GID fields, clearing all Linux capability sets, and setting `PR_SET_NO_NEW_PRIVS`) before executing any fingerprint binary. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (6)