RHSA-2026:89232

Vulnerability from csaf_redhat - Published: 2026-10-27 12:02 - Updated: 2026-10-29 07:14
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.21.40 bug fix and security update
Severity
Critical
Notes
Topic: Red Hat OpenShift Container Platform release 4.21.40 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.21.40. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:89229 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ Security Fix(es): * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999) * kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) * gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182) * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183) * gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011) * gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs (CVE-2026-42012) * gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013) * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445) * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995) * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863) * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864) * ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-5260

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
Unresolved product id: 9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-10723

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
CWE-345 - Insufficient Verification of Data Authenticity
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-34182

A flaw was found in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-130 - Improper Handling of Length Parameter Inconsistency
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-34183

A flaw was found in OpenSSL's QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-42011

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-42012

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.

7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-42013

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-45445

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-1204 - Generation of Weak Initialization Vector (IV)
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-45447

A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Important
CVE-2026-59995

A flaw was found in OpenSSH. The `sftp` client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or placing malicious files in sensitive directories on the client system, which could compromise system integrity.

5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-59999

A flaw was found in `sshd`, the OpenSSH server daemon. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-358 - Improperly Implemented Security Check for Standard
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Important
CVE-2026-64564

A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF (Add IP Address Configuration) chunks, including DEL-IP (Delete IP Address) parameters, to trigger a use-after-free condition. This memory corruption could lead to a system crash, resulting in a denial of service, and potentially allow for arbitrary code execution.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Important
CVE-2026-80792

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the `ip6_finish_output2()` function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive kernel data, misdirect network traffic, or cause a system crash (Denial of Service).

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Important
CVE-2026-80863

A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the `free_rd_atomic_resources()` function by updating the `max_dest_rd_atomic` value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a system crash, resulting in a denial of service (DoS).

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-80864

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker to cause a system crash and resulting in a Denial of Service (DoS).

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Moderate
CVE-2026-86145

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE-787 - Out-of-bounds Write
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Important
CVE-2026-89161

A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.

7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-1341 - Multiple Releases of Same Resource or Handle
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Important
CVE-2026-99999

A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory.

8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Important
CVE-2026-103111

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).

7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CWE-787 - Out-of-bounds Write
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Important
CVE-2026-114406

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 4 products, the same list as for CVE-2026-5260
Threats
Impact Critical
References
URL Category
https://access.redhat.com/errata/RHSA-2026:89232 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2467437 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467441 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467448 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467450 external
https://bugzilla.redhat.com/show_bug.cgi?id=2481884 external
https://bugzilla.redhat.com/show_bug.cgi?id=2481885 external
https://bugzilla.redhat.com/show_bug.cgi?id=2481896 external
https://bugzilla.redhat.com/show_bug.cgi?id=2481898 external
https://bugzilla.redhat.com/show_bug.cgi?id=2497927 external
https://bugzilla.redhat.com/show_bug.cgi?id=2497942 external
https://bugzilla.redhat.com/show_bug.cgi?id=2504560 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510890 external
https://bugzilla.redhat.com/show_bug.cgi?id=2528542 external
https://bugzilla.redhat.com/show_bug.cgi?id=2528646 external
https://bugzilla.redhat.com/show_bug.cgi?id=2528665 external
https://bugzilla.redhat.com/show_bug.cgi?id=2528993 external
https://bugzilla.redhat.com/show_bug.cgi?id=2531747 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543797 external
https://bugzilla.redhat.com/show_bug.cgi?id=2553429 external
https://bugzilla.redhat.com/show_bug.cgi?id=2556046 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-5260 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467450 external
https://www.cve.org/CVERecord?id=CVE-2026-5260 external
https://nvd.nist.gov/vuln/detail/CVE-2026-5260 external
https://www.gnutls.org/security-new.html#GNUTLS-S… external
https://access.redhat.com/security/cve/CVE-2026-10723 self
https://bugzilla.redhat.com/show_bug.cgi?id=2504560 external
https://www.cve.org/CVERecord?id=CVE-2026-10723 external
https://nvd.nist.gov/vuln/detail/CVE-2026-10723 external
https://access.redhat.com/security/cve/CVE-2026-34182 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481884 external
https://www.cve.org/CVERecord?id=CVE-2026-34182 external
https://nvd.nist.gov/vuln/detail/CVE-2026-34182 external
https://access.redhat.com/security/cve/CVE-2026-34183 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481885 external
https://www.cve.org/CVERecord?id=CVE-2026-34183 external
https://nvd.nist.gov/vuln/detail/CVE-2026-34183 external
https://access.redhat.com/security/cve/CVE-2026-42011 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467437 external
https://www.cve.org/CVERecord?id=CVE-2026-42011 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42011 external
https://www.gnutls.org/security-new.html#GNUTLS-S… external
https://access.redhat.com/security/cve/CVE-2026-42012 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467441 external
https://www.cve.org/CVERecord?id=CVE-2026-42012 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42012 external
https://www.gnutls.org/security-new.html#GNUTLS-S… external
https://access.redhat.com/security/cve/CVE-2026-42013 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467448 external
https://www.cve.org/CVERecord?id=CVE-2026-42013 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42013 external
https://www.gnutls.org/security-new.html#GNUTLS-S… external
https://access.redhat.com/security/cve/CVE-2026-45445 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481896 external
https://www.cve.org/CVERecord?id=CVE-2026-45445 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45445 external
https://access.redhat.com/security/cve/CVE-2026-45447 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481898 external
https://www.cve.org/CVERecord?id=CVE-2026-45447 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45447 external
https://access.redhat.com/security/cve/CVE-2026-59995 self
https://bugzilla.redhat.com/show_bug.cgi?id=2497927 external
https://www.cve.org/CVERecord?id=CVE-2026-59995 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59995 external
https://marc.info/?l=openssh-unix-dev&m=178333966… external
https://www.openssh.org/releasenotes.html#10.4p1 external
https://www.openwall.com/lists/oss-security/2026/… external
https://access.redhat.com/security/cve/CVE-2026-59999 self
https://bugzilla.redhat.com/show_bug.cgi?id=2497942 external
https://www.cve.org/CVERecord?id=CVE-2026-59999 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59999 external
https://access.redhat.com/security/cve/CVE-2026-64564 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510890 external
https://www.cve.org/CVERecord?id=CVE-2026-64564 external
https://nvd.nist.gov/vuln/detail/CVE-2026-64564 external
https://lore.kernel.org/linux-cve-announce/202608… external
https://access.redhat.com/security/cve/CVE-2026-80792 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528542 external
https://www.cve.org/CVERecord?id=CVE-2026-80792 external
https://nvd.nist.gov/vuln/detail/CVE-2026-80792 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2026-80863 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528665 external
https://www.cve.org/CVERecord?id=CVE-2026-80863 external
https://nvd.nist.gov/vuln/detail/CVE-2026-80863 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2026-80864 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528646 external
https://www.cve.org/CVERecord?id=CVE-2026-80864 external
https://nvd.nist.gov/vuln/detail/CVE-2026-80864 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2026-86145 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528993 external
https://www.cve.org/CVERecord?id=CVE-2026-86145 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86145 external
https://github.com/PCRE2Project/pcre2/releases/ta… external
https://github.com/PCRE2Project/pcre2/security/ad… external
https://access.redhat.com/security/cve/CVE-2026-89161 self
https://bugzilla.redhat.com/show_bug.cgi?id=2531747 external
https://www.cve.org/CVERecord?id=CVE-2026-89161 external
https://nvd.nist.gov/vuln/detail/CVE-2026-89161 external
https://github.com/PCRE2Project/pcre2/pull/937 external
https://access.redhat.com/security/cve/CVE-2026-99999 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553429 external
https://www.cve.org/CVERecord?id=CVE-2026-99999 external
https://nvd.nist.gov/vuln/detail/CVE-2026-99999 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2026-103111 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543797 external
https://www.cve.org/CVERecord?id=CVE-2026-103111 external
https://nvd.nist.gov/vuln/detail/CVE-2026-103111 external
https://github.com/PCRE2Project/pcre2/security/ad… external
https://access.redhat.com/security/cve/CVE-2026-114406 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556046 external
https://access.redhat.com/security/vulnerabilitie… external
https://www.cve.org/CVERecord?id=CVE-2026-114406 external
https://nvd.nist.gov/vuln/detail/CVE-2026-114406 external
Acknowledgments
AISLE Research Team Joshua Rogers
Stella Haruto Kimura
1Seal Oleh Konko
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.21.40 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.21.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.21.40. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHSA-2026:89229\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nSecurity Fix(es):\n\n* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n* openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)\n* kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing (CVE-2026-64564)\n* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)\n* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)\n* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)\n* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)\n* gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260)\n* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)\n* openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n* openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n* gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011)\n* gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs (CVE-2026-42012)\n* gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013)\n* openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n* openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)\n* kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)\n* kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)\n* ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)\n* kernel: ipv4: validate checksum_start before completing checksum  (CVE-2026-99999)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:89232",
        "url": "https://access.redhat.com/errata/RHSA-2026:89232"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "2467437",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
      },
      {
        "category": "external",
        "summary": "2467441",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
      },
      {
        "category": "external",
        "summary": "2467448",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
      },
      {
        "category": "external",
        "summary": "2467450",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
      },
      {
        "category": "external",
        "summary": "2481884",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
      },
      {
        "category": "external",
        "summary": "2481885",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
      },
      {
        "category": "external",
        "summary": "2481896",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
      },
      {
        "category": "external",
        "summary": "2481898",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
      },
      {
        "category": "external",
        "summary": "2497927",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497927"
      },
      {
        "category": "external",
        "summary": "2497942",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497942"
      },
      {
        "category": "external",
        "summary": "2504560",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
      },
      {
        "category": "external",
        "summary": "2510890",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510890"
      },
      {
        "category": "external",
        "summary": "2528542",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528542"
      },
      {
        "category": "external",
        "summary": "2528646",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528646"
      },
      {
        "category": "external",
        "summary": "2528665",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528665"
      },
      {
        "category": "external",
        "summary": "2528993",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528993"
      },
      {
        "category": "external",
        "summary": "2531747",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
      },
      {
        "category": "external",
        "summary": "2543797",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
      },
      {
        "category": "external",
        "summary": "2553429",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553429"
      },
      {
        "category": "external",
        "summary": "2556046",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89232.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.21.40 bug fix and security update",
    "tracking": {
      "current_release_date": "2026-10-29T07:14:50+00:00",
      "generator": {
        "date": "2026-10-29T07:14:50+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:89232",
      "initial_release_date": "2026-10-27T12:02:53+00:00",
      "revision_history": [
        {
          "date": "2026-10-27T12:02:53+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-27T12:02:53+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-29T07:14:50+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.21",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.21",
                  "product_id": "9Base-RHOSE-4.21",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.21::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-aarch64-4.21.9.6.202610241345-0",
                "product": {
                  "name": "rhcos-aarch64-4.21.9.6.202610241345-0",
                  "product_id": "rhcos-aarch64-4.21.9.6.202610241345-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.21.9.6.202610241345?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-ppc64le-4.21.9.6.202610241345-0",
                "product": {
                  "name": "rhcos-ppc64le-4.21.9.6.202610241345-0",
                  "product_id": "rhcos-ppc64le-4.21.9.6.202610241345-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.21.9.6.202610241345?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-s390x-4.21.9.6.202610241345-0",
                "product": {
                  "name": "rhcos-s390x-4.21.9.6.202610241345-0",
                  "product_id": "rhcos-s390x-4.21.9.6.202610241345-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.21.9.6.202610241345?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-x86_64-4.21.9.6.202610241345-0",
                "product": {
                  "name": "rhcos-x86_64-4.21.9.6.202610241345-0",
                  "product_id": "rhcos-x86_64-4.21.9.6.202610241345-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.21.9.6.202610241345?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-aarch64-4.21.9.6.202610241345-0 as a component of Red Hat OpenShift Container Platform 4.21",
          "product_id": "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0"
        },
        "product_reference": "rhcos-aarch64-4.21.9.6.202610241345-0",
        "relates_to_product_reference": "9Base-RHOSE-4.21"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-ppc64le-4.21.9.6.202610241345-0 as a component of Red Hat OpenShift Container Platform 4.21",
          "product_id": "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0"
        },
        "product_reference": "rhcos-ppc64le-4.21.9.6.202610241345-0",
        "relates_to_product_reference": "9Base-RHOSE-4.21"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-s390x-4.21.9.6.202610241345-0 as a component of Red Hat OpenShift Container Platform 4.21",
          "product_id": "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0"
        },
        "product_reference": "rhcos-s390x-4.21.9.6.202610241345-0",
        "relates_to_product_reference": "9Base-RHOSE-4.21"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-4.21.9.6.202610241345-0 as a component of Red Hat OpenShift Container Platform 4.21",
          "product_id": "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        },
        "product_reference": "rhcos-x86_64-4.21.9.6.202610241345-0",
        "relates_to_product_reference": "9Base-RHOSE-4.21"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Joshua Rogers"
          ],
          "organization": "AISLE Research Team"
        }
      ],
      "cve": "CVE-2026-5260",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2026-05-06T19:50:31.302000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467450"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: gnutls: Information disclosure via heap overread in RSA key exchange",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this vulnerability as Moderate severity because exploitation requires a specialized server setup where RSA key exchange is negotiated using a private key hosted on a PKCS#11 token. In standard Red Hat Enterprise Linux deployments, system-wide crypto policies prioritize forward-secret (EC)DHE cipher suites, and PKCS#11 hardware tokens are not configured by default. Furthermore, the issue only triggers a bounded heap overread, resulting in limited information disclosure rather than arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5260"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467450",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5260",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5260"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5260",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5260"
        },
        {
          "category": "external",
          "summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10",
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10"
        }
      ],
      "release_date": "2026-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gnutls: gnutls: Information disclosure via heap overread in RSA key exchange"
    },
    {
      "cve": "CVE-2026-10723",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-07-21T21:13:55.893000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504560"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: bind9: Incorrect acceptance of NSEC3 records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in BIND allows an attacker to forge authenticated NXDOMAIN responses for sibling zones due to incorrect validation of child-zone NSEC3 records. Exploitation requires high attack complexity, limiting the immediate risk to Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10723"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504560",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10723",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10723"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind: bind9: Incorrect acceptance of NSEC3 records"
    },
    {
      "cve": "CVE-2026-34182",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-05-27T13:59:43+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481884"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL\u0027s Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: This flaw in OpenSSL\u0027s Cryptographic Message Services (CMS) AuthEnvelopedData processing could allow an on-path attacker to forge messages or bypass integrity validation. This is due to insufficient input validation on cipher and tag length fields, potentially leading to key-equivalent functionality or integrity bypass in applications utilizing affected OpenSSL versions for CMS AuthEnvelopedData.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34182"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481884",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34182",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34182"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Systems configured to operate in FIPS mode are not affected by this vulnerability. To mitigate this issue, ensure that OpenSSL is operating in FIPS mode by enabling the system-wide FIPS policy. This may have broader implications for cryptographic operations on the system and should be evaluated for compatibility with existing applications. A system reboot may be required for the changes to take effect.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages"
    },
    {
      "cve": "CVE-2026-34183",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-27T14:04:59+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481885"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL\u0027s QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate severity flaw exists in the QUIC PATH_CHALLENGE handler, allowing a remote attacker to exhaust heap memory of a QUIC client or server. By flooding the local QUIC stack with PATH_CHALLENGE frames, a malicious peer can trigger unbounded memory allocation, leading to a denial of service for applications utilizing the vulnerable QUIC implementation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34183"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481885",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34183",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34183"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34183",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34183"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, apply UDP rate limiting at your network edge to throttle malicious traffic. If QUIC is not strictly required, disable the listener entirely and configure your application to use standard TLS over TCP. Additionally, enforce strict process memory limits using cgroups to prevent host-wide memory exhaustion during an attack.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Haruto Kimura"
          ],
          "organization": "Stella"
        }
      ],
      "cve": "CVE-2026-42011",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-05-06T19:06:25.319000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467437"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: gnutls: Security bypass due to incorrect name constraint handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42011"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467437",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42011",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42011"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011"
        },
        {
          "category": "external",
          "summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6",
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6"
        }
      ],
      "release_date": "2026-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gnutls: gnutls: Security bypass due to incorrect name constraint handling"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Oleh Konko"
          ],
          "organization": "1Seal"
        }
      ],
      "cve": "CVE-2026-42012",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-05-06T19:16:02.753000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467441"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because exploitation requires an active man-in-the-middle position or tricking a client into connecting to a rogue endpoint, along with obtaining a validly signed certificate containing specialized SAN fields. While GnuTLS is widely deployed across Red Hat products as a core cryptographic library, the impact is limited to hostname verification spoofing under specific certificate configurations. The issue does not permit remote code execution or direct compromise of the underlying system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42012"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467441",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42012",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42012"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42012",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42012"
        },
        {
          "category": "external",
          "summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7",
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7"
        }
      ],
      "release_date": "2026-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Haruto Kimura"
          ],
          "organization": "Stella"
        },
        {
          "names": [
            "Joshua Rogers"
          ],
          "organization": "AISLE Research Team"
        }
      ],
      "cve": "CVE-2026-42013",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-05-06T19:47:00.134000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467448"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate impact across affected Red Hat products because successful exploitation requires an active man-in-the-middle network position as well as a certificate issued by a trusted authority matching the target hostname\u0027s Common Name. Although TLS clients using GnuTLS on Red Hat Enterprise Linux and OpenShift are susceptible to improper certificate acceptance under these conditions, modern certificate authorities rarely issue certificates that omit valid Subject Alternative Names, substantially restricting practical threat vectors. Applications functioning exclusively as TLS servers or utilizing alternative cryptographic libraries like OpenSSL are not exposed to this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42013"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467448",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42013",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42013"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42013",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42013"
        },
        {
          "category": "external",
          "summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8",
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8"
        }
      ],
      "release_date": "2026-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name"
    },
    {
      "cve": "CVE-2026-45445",
      "cwe": {
        "id": "CWE-1204",
        "name": "Generation of Weak Initialization Vector (IV)"
      },
      "discovery_date": "2026-05-27T14:17:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481896"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Moderate severity flaw where applications utilizing the AES-OCB cipher through OpenSSL\u0027s EVP_Cipher() one-shot interface may silently discard the provided initialization vector (IV). This leads to nonce reuse, compromising confidentiality and enabling universal forgery of authentication tags. Red Hat products are primarily affected if they include or rely on third-party applications that specifically employ this less common and discouraged API usage with AES-OCB, as standard OpenSSL SSL/TLS implementations and applications using the recommended streaming AEAD API are not impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45445"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481896",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45445",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45445"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45445",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45445"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path"
    },
    {
      "cve": "CVE-2026-45447",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-05-27T14:17:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481898"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This High severity heap use-after-free flaw in OpenSSL\u0027s PKCS7_verify() function can be triggered by processing a specially crafted PKCS#7 or S/MIME signed message. This could lead to application crashes, memory corruption, or potentially remote code execution, impacting services that handle such messages. The vulnerability specifically affects applications utilizing OpenSSL PKCS#7 APIs, while those using CMS APIs are not impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45447"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481898",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45447",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45447"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()"
    },
    {
      "cve": "CVE-2026-59995",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-07-08T01:01:01.518880+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. The `sftp` client, when used to download files from a malicious server with the \u0027sftp server:/path .\u0027 command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or placing malicious files in sensitive directories on the client system, which could compromise system integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: sftp client allows attacker to control downloaded file location",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59995"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59995",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59995"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59995",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59995"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:04:49.995000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid using the `sftp server:/path .` command when connecting to untrusted or potentially malicious SFTP servers. Exercise caution and verify the authenticity of SFTP servers before initiating file transfers, especially when using commands that implicitly define the download destination, and also avoid running SFTP sessions with elevated privileges (such as root).",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: OpenSSH: sftp client allows attacker to control downloaded file location"
    },
    {
      "cve": "CVE-2026-59999",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-07-08T01:01:55.619428+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497942"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `sshd`, the OpenSSH server daemon. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate severity flaw in OpenSSH `sshd` allows `PermitTunnel=yes` to override `DisableForwarding=yes`, potentially bypassing intended security controls. In Red Hat environments where `DisableForwarding` is used to restrict SSH session capabilities, an attacker who compromises a user\u0027s session could still establish a tunnel, leading to unauthorized network access or data exfiltration. This bypass occurs even when administrators explicitly attempt to prevent forwarding, though `PermitTunnel` is not enabled by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59999"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497942",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497942"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59999",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59999"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59999",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59999"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:13:08.397000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, if `DisableForwarding=yes` is set in `/etc/ssh/sshd_config` to prevent all forwarding, ensure that `PermitTunnel` is explicitly set to `no` in the same configuration file. This will enforce the intended security policy.\n\nAfter modifying `/etc/ssh/sshd_config`, restart the `sshd` service for the changes to take effect. This may temporarily interrupt active SSH sessions.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options"
    },
    {
      "cve": "CVE-2026-64564",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510890"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF (Add IP Address Configuration) chunks, including DEL-IP (Delete IP Address) parameters, to trigger a use-after-free condition. This memory corruption could lead to a system crash, resulting in a denial of service, and potentially allow for arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64564"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510890",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510890"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64564",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64564"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64564",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64564"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T"
        }
      ],
      "release_date": "2026-08-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content:\n\n```\ninstall sctp /bin/true\nblacklist sctp\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing"
    },
    {
      "cve": "CVE-2026-80792",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528542"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s IPv6 networking stack. A use-after-free vulnerability exists in the `ip6_finish_output2()` function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive kernel data, misdirect network traffic, or cause a system crash (Denial of Service).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: ipv6: fix use-after-free in ip6_finish_output2()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80792"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528542",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528542"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80792",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80792"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80792",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80792"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80792.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80792.mbox"
        }
      ],
      "release_date": "2026-09-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: ipv6: fix use-after-free in ip6_finish_output2()"
    },
    {
      "cve": "CVE-2026-80863",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528665"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the `free_rd_atomic_resources()` function by updating the `max_dest_rd_atomic` value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a system crash, resulting in a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An OOB write in RDMA/RXE free_rd_atomic_resources can occur because qp attr max_dest_rd_atomic is updated before the old rd atomic resources array is freed. The free path then uses the new larger bound while walking the old smaller allocation, which can write past the kmalloc object and corrupt slab memory. The issue is not directly network reachable because the triggering operation is a local uverbs control path rather than inbound RDMA traffic.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80863"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528665",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528665"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80863",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80863"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80863",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80863"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80863.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80863.mbox"
        }
      ],
      "release_date": "2026-09-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, prevent module rdma_rxe from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()"
    },
    {
      "cve": "CVE-2026-80864",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528646"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s Remote Direct Memory Access (RDMA) subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker to cause a system crash and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80864"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528646",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528646"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80864",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80864"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80864",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80864"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80864.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80864.mbox"
        }
      ],
      "release_date": "2026-09-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, prevent the rdma_rxe kernel module from being loaded.\n\n1. Create a configuration file in /etc/modprobe.d to disable loading of the module:\n# echo \"install rdma_rxe /bin/true\" \u003e /etc/modprobe.d/disable-rdma_rxe.conf\n\n2. If the module is currently loaded, attempt to unload it:\n# modprobe -r rdma_rxe\n\nCaveats:\nDisabling this module prevents the creation and operation of software RDMA over Converged Ethernet (Soft-RoCE) devices. Applications requiring rdma_rxe will fail to initialize. If the module is currently in active use and cannot be unloaded dynamically, a system reboot is required to ensure the module is fully disabled.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp"
    },
    {
      "cve": "CVE-2026-86145",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-05T05:20:54.676360+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: An out-of-bounds write vulnerability in the PCRE2 library, specifically within the `pcre2_dfa_match` function, could allow arbitrary code execution. This flaw is exploitable in Red Hat products when processing attacker-controlled regular expressions or when a recursive pattern is used in conjunction with a small, API-set heap limit, making it dependent on specific application usage patterns.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf",
          "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf"
        }
      ],
      "release_date": "2026-09-05T05:09:25.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches\u2014such as the reuse of cached memory workspaces\u2014enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions"
    },
    {
      "cve": "CVE-2026-89161",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-09-11T04:21:06.963234+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important memory corruption vulnerability in PCRE2\u0027s JIT compiler. An attacker could exploit a flaw in `pcre2_jit_match` when a previously copied subject is passed as context, potentially leading to arbitrary code execution or denial of service. The high attack complexity and local attack vector reduce the overall risk, but the widespread use of PCRE2 and the potential for severe impact warrant the Important classification.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89161"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89161",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89161"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/pull/937",
          "url": "https://github.com/PCRE2Project/pcre2/pull/937"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        }
      ],
      "release_date": "2026-09-11T04:11:51.666000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match"
    },
    {
      "cve": "CVE-2026-99999",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553429"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: ipv4: validate checksum_start before completing checksum",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This IMPORTANT-severity flaw affects the Linux kernel as shipped in Red Hat products, including the kernel and kernel-rt packages in Red Hat Enterprise Linux and the kernels shipped in Red Hat In-Vehicle OS. The IPv4 networking subsystem does not validate packet checksum metadata before completing a checksum: when a packet with a malformed checksum_start value enters the IPv4 stack, skb_checksum_help() can write out of bounds and corrupt the network header and other kernel memory (CWE-787). A local attacker or an untrusted guest virtual machine able to transmit such packets into an affected host could exploit this to crash the system (denial of service), disclose sensitive kernel memory, or potentially execute arbitrary code on the host. Red Hat tracks this flaw as a KEV active-exploit case. All currently tracked Red Hat product streams are marked affected, and fixes are being pursued by the responsible Red Hat product teams under delegated resolution. Red Hat\u0027s severity differs from the upstream assessment: Red Hat assigns a CVSS 3.1 score of 8.8 (IMPORTANT, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), while the CVE.org record assigns 9.3 (CRITICAL, AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); the two assessments differ on the privileges-required metric.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-99999"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553429",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553429"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-99999",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-99999"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-99999",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99999"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox"
        }
      ],
      "release_date": "2026-10-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: ipv4: validate checksum_start before completing checksum"
    },
    {
      "cve": "CVE-2026-103111",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-30T04:40:56.869940+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-103111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-103111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-103111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m",
          "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m"
        }
      ],
      "release_date": "2026-09-30T04:13:59.115000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression"
    },
    {
      "cve": "CVE-2026-114406",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:01:55.916000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556046"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
          "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114406"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556046",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114406",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114406"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406"
        }
      ],
      "release_date": "2026-10-20T13:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T12:02:53+00:00",
          "details": "For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d\n\n      (For s390x architecture)\n      The image digest is sha256:f244c744be1512521b08b50750247a0d2ac39a9b0be7038f0a38726205736059\n\n      (For ppc64le architecture)\n      The image digest is sha256:2ace80011c5708d6f3fe68bed3c713c1d99d3b579d2c147d34df581e6fe2e9bd\n\n      (For aarch64 architecture)\n      The image digest is sha256:2356c5c4143d3bab1f95335aa96bb1caf251417bcbaaa2dae517b59b03e58b02\n\nAll OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89232"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.21:rhcos-aarch64-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-ppc64le-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-s390x-4.21.9.6.202610241345-0",
            "9Base-RHOSE-4.21:rhcos-x86_64-4.21.9.6.202610241345-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.