RHSA-2026:89839HighCVSS 8.2

Red Hat Security Advisory: OpenShift Container Platform 4.14.77 bug fix and security update

Published
October 27, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (6)

CVE-2026-14362 →CVE-2026-33814 →CVE-2026-39821 →CVE-2026-55204 →CVE-2026-59887 →CVE-2026-111943 →

📋 Description

CVE-2026-14362 — github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-55204 — haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-59887 — linkify-it: linkify-it: Denial of Service via crafted mailto: links CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:2888ae40098fc294f0c419ee06790a20b51f8b2145dbd8a1ea6c4486eddb7b49_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:9aa8508364f1dd8beee2685bc8c0f7ab21ca1b6df9f9470d835d2f840293fd07_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:a5706e19678f56fe10ce5d8b408852ee056a793cf47e731969d744688f38f89d_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:f3b7f9144f36a593878f52a8bf78e50c44c69e0a067dbbb4648aadc9fd47ba85_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0dac03fdc234fd7b6c7c2f880ec3aee7a27b104a429fd27023d4bcbcab330e91_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:12a16c4937201d04f443c45dcf0ce35ea2f51614d127c82dc96b9333ce92f071_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:6e351d68348ab70bef8457b5d81a2dbbcecab65fd46c90bd86c36f02bca2acac_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:fa21671e0a2daef4f3465b59b8c72a77eb72d18b42eb89fb0024bdca5ba2db44_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:092600bd6f1916b2238b477de5a3b4279a30c9864597def09c2b04359aa29527_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:312a45fe4e0a4904b5e76cc1ea946558231d650ac8a5f4c80862d8dcc6e3ae77_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:ab21e25b05c4c38dd500cfdef2fafbc63ac089906e371b1339ba2b3f6915188a_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:e6f620b798bb9fa2139e8db3ca6d693ffde43f8b05dab56c087598eea074a14e_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:35f70b4c6a8789ea5c01105260d00a07bfd4e01656e06ced44022cd6c3f39cb5_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:c8221569e70b3f4d8e39c09073273f0e3a5825dac7d88b828e9dad62c5e64700_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:e68a7c8852377a5f50289567782f60cb96a3527fa3bc4fc79bf1e333779b2737_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:f38e435a08437c11a6306a97edf83429a766837df1d0a673d98a7b1eefe3432c_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:0a06ce1fcebb494f67e420717304816316144b6c0b35b3b0fdbe5f7ae01bc460_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:42ff9accbcddb1f0cdb3cdf04d228192e3f82292b58de028ae76162f26058b9f_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:dc7d3ec6067b993daa3761aa521031f12ad1073647d974ab13cc4a7f3c36cd0d_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:ed746e1a4351f7814c22c50d96906aa3795c7016fee7f5a4e59ea39b1daf7906_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:19ed56d74559f5301668a6b6784cb0a9b31ca10d18ef2140dd8e9ecf1875f1c1_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:41d04d6b4d68a67279639c96f67d87bed47a4df8df5a30998eae3e7be9bd578d_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:74866ff11296bec710f9df5c7e18194f8c1fc84233dbc9948ed25b720e369c2c_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:8e1334c61d3ce2d9379bc969ffe67ecbf60b11182d9e0967960e3f670394420d_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:1516251b89dfae0ec855c7ca672209c4d40f78e232c059b05c585b5ab7f41ec2_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:2615ea9ffb2b095b92ba9b821357eba8f1202d55b165dc05c8fa8c56247e104d_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:4c1ad0175d19c9ae2f5bb627659e8b286da36e45f714928e63a8caea0e21c3c8_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:cc35b94a4563d6efd46ff4e4ba1c8686f66557c4777c6535ecf72d10a3b668cf_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:1070b63cb111b302726b5e17671ce939912fa1d2dde00ed5ee34b7588c3ddbb5_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:37f1faf5a14324a24756dd53c07e91e51616110aa5535b0c54471a43a8cf14fa (For s390x architecture) The image digest is sha256:fbe773c859fae7da27a998508d4f875d9add8eb42224870c62a291d7104853aa (For ppc64le architecture) The image digest is sha256:70f9848df813a062885bbc6c5a24c6916c7b9da8560515c230763e82c72a089f (For aarch64 architecture) The image digest is sha256:0cc9177f9eba20e2136a9e06389810d89d298c387424b9398164e5fa4af4aec3 All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Upgrade github.com/hashicorp/memberlist to version 0.6.0 or later, which fixes the push/pull state handling issue. As a temporary mitigation, restrict network access to the gossip port (UDP/TCP, commonly 7946 or 9094) to trusted cluster members only, e.g. via network policy, firewall rules, or security groups, since the flaw requires network access to the gossip listener to trigger memory exhaustion. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (9)