RHSA-2026:66357
Vulnerability from csaf_redhat - Published: 2026-09-15 10:01 - Updated: 2026-09-15 11:38Summary
Red Hat Security Advisory: OpenShift Container Platform 4.22.14 bug fix and security update
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.22.14 is now available with
updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container
Platform 4.22.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.22.14. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:66356
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
Security Fix(es):
* curl: curl: Insecure connection establishment due to TLS configuration
mismatch (CVE-2026-8286)
* curl: curl: Man-in-the-middle attack via SSH host key bypass
(CVE-2026-9547)
* bind: bind9: Cache poisoning via label count discrepancy, RRSIG,
wildcards (CVE-2026-11721)
* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer
overflow in FTS5 (CVE-2026-11824)
* bind: bind9: Unexpected exit with NSEC and NSEC3 both present
(CVE-2026-13204)
* dracut: dracut: root code execution via unescaped error message written
to sourced emergency hook script in die() (CVE-2026-15816)
* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
(CVE-2026-43133)
* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel
option (CVE-2026-55973)
* glib: off-by-one error in glib/gkeyfile.c via
"g_key_file_get_locale_string_list" (CVE-2026-58014)
* glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via
keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015)
* kbd: Local privilege escalation in openvt via incorrect process owner
verification allowing passwordless root login (CVE-2026-72693)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Important
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default).
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Important
A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Important
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Important
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Important
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) nSVM module. When a nested virtual machine (L2 guest) executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor (L1), KVM incorrectly uses `vmcb02` instead of `vmcb01` for managing guest state. This incorrect Virtual Machine Control Block (VMCB) handling could lead to unexpected behavior or state corruption within the virtualized environment.
7.9 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Important
A flaw was found in Unbound. When the 'dns-error-reporting: yes' option is enabled, a remote attacker can send a specially crafted DNS response containing a malformed EDNS Report-Channel option from a delegated zone they control. This can lead to a stack variable overwrite, causing the Unbound daemon to terminate. This vulnerability results in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Important
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
7.3 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Moderate
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
5.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Moderate
`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8286
Threats
Impact
Moderate
References
75 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.22.14 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\n This release includes a security update for Red Hat OpenShift Container\nPlatform 4.22.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.22.14. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHSA-2026:66356\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nSecurity Fix(es):\n\n* curl: curl: Insecure connection establishment due to TLS configuration\nmismatch (CVE-2026-8286)\n* curl: curl: Man-in-the-middle attack via SSH host key bypass\n(CVE-2026-9547)\n* bind: bind9: Cache poisoning via label count discrepancy, RRSIG,\nwildcards (CVE-2026-11721)\n* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer\noverflow in FTS5 (CVE-2026-11824)\n* bind: bind9: Unexpected exit with NSEC and NSEC3 both present\n(CVE-2026-13204)\n* dracut: dracut: root code execution via unescaped error message written\nto sourced emergency hook script in die() (CVE-2026-15816)\n* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation\n(CVE-2026-43133)\n* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel\noption (CVE-2026-55973)\n* glib: off-by-one error in glib/gkeyfile.c via\n\"g_key_file_get_locale_string_list\" (CVE-2026-58014)\n* glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via\nkeyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015)\n* kbd: Local privilege escalation in openvt via incorrect process owner\nverification allowing passwordless root login (CVE-2026-72693)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:66357",
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2462115",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462115"
},
{
"category": "external",
"summary": "2467065",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467065"
},
{
"category": "external",
"summary": "2487269",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
},
{
"category": "external",
"summary": "2492255",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255"
},
{
"category": "external",
"summary": "2492256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256"
},
{
"category": "external",
"summary": "2496758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496758"
},
{
"category": "external",
"summary": "2496763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
},
{
"category": "external",
"summary": "2500889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
},
{
"category": "external",
"summary": "2503075",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503075"
},
{
"category": "external",
"summary": "2504338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504338"
},
{
"category": "external",
"summary": "2504447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504447"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66357.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.22.14 bug fix and security update",
"tracking": {
"current_release_date": "2026-09-15T11:38:01+00:00",
"generator": {
"date": "2026-09-15T11:38:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.21"
}
},
"id": "RHSA-2026:66357",
"initial_release_date": "2026-09-15T10:01:11+00:00",
"revision_history": [
{
"date": "2026-09-15T10:01:11+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-15T10:01:11+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-15T11:38:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.22",
"product": {
"name": "Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.22::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-aarch64-4.22.9.8.202609081748-0",
"product": {
"name": "rhcos-aarch64-4.22.9.8.202609081748-0",
"product_id": "rhcos-aarch64-4.22.9.8.202609081748-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202609081748?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-ppc64le-4.22.9.8.202609081748-0",
"product": {
"name": "rhcos-ppc64le-4.22.9.8.202609081748-0",
"product_id": "rhcos-ppc64le-4.22.9.8.202609081748-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202609081748?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-s390x-4.22.9.8.202609081748-0",
"product": {
"name": "rhcos-s390x-4.22.9.8.202609081748-0",
"product_id": "rhcos-s390x-4.22.9.8.202609081748-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202609081748?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-4.22.9.8.202609081748-0",
"product": {
"name": "rhcos-x86_64-4.22.9.8.202609081748-0",
"product_id": "rhcos-x86_64-4.22.9.8.202609081748-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202609081748?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-aarch64-4.22.9.8.202609081748-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0"
},
"product_reference": "rhcos-aarch64-4.22.9.8.202609081748-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-ppc64le-4.22.9.8.202609081748-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0"
},
"product_reference": "rhcos-ppc64le-4.22.9.8.202609081748-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-s390x-4.22.9.8.202609081748-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0"
},
"product_reference": "rhcos-s390x-4.22.9.8.202609081748-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-4.22.9.8.202609081748-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
},
"product_reference": "rhcos-x86_64-4.22.9.8.202609081748-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-8286",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-07-03T07:01:27.043110+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496763"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Insecure connection establishment due to TLS configuration mismatch",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw as `curl` may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where `curl` is used for sensitive data transfers and relies on STARTTLS for security.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8286"
},
{
"category": "external",
"summary": "RHBZ#2496763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8286.html",
"url": "https://curl.se/docs/CVE-2026-8286.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8286.json",
"url": "https://curl.se/docs/CVE-2026-8286.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3718195",
"url": "https://hackerone.com/reports/3718195"
}
],
"release_date": "2026-07-03T06:14:17.541000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
},
{
"cve": "CVE-2026-9547",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-07-03T07:01:12.182841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496758"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server\u0027s host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Man-in-the-middle attack via SSH host key bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where libcurl-based applications performing SCP or SFTP transfers with the CURLOPT_SSH_KEYFUNCTION callback may silently accept an untrusted server. This occurs when a server presents a host key type that differs from the one recorded in the known_hosts file, bypassing a critical host key verification and enabling potential man-in-the-middle attacks. The vulnerability requires specific application callback usage, not a general curl client default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9547"
},
{
"category": "external",
"summary": "RHBZ#2496758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496758"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9547"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9547.html",
"url": "https://curl.se/docs/CVE-2026-9547.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9547.json",
"url": "https://curl.se/docs/CVE-2026-9547.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3751712",
"url": "https://hackerone.com/reports/3751712"
}
],
"release_date": "2026-07-03T06:18:44.499000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: curl: Man-in-the-middle attack via SSH host key bypass"
},
{
"cve": "CVE-2026-11721",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"discovery_date": "2026-07-21T20:22:21.905000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504338"
}
],
"notes": [
{
"category": "description",
"text": "It is possible for an attacker\u0027s zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker\u0027s zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11721"
},
{
"category": "external",
"summary": "RHBZ#2504338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11721",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11721"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11721",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11721"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards"
},
{
"cve": "CVE-2026-11824",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-06-09T20:02:19.874232+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487269"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in SQLite\u0027s FTS5 full-text search extension can lead to arbitrary code execution or application crashes due to a heap-based buffer overflow. Exploitation requires an attacker to provide a specially crafted SQLite database, which must then be processed by an application compiled with FTS5 support. While requiring user interaction and local access, the potential for full impact on system resources justifies the Important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11824"
},
{
"category": "external",
"summary": "RHBZ#2487269",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_53_2.html",
"url": "https://sqlite.org/releaselog/3_53_2.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/061febcf41ca",
"url": "https://sqlite.org/src/info/061febcf41ca"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/4a5ad516ea93",
"url": "https://sqlite.org/src/info/4a5ad516ea93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate",
"url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate"
}
],
"release_date": "2026-06-09T19:21:42.603000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
},
{
"cve": "CVE-2026-13204",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-07-21T20:41:55.541000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504447"
}
],
"notes": [
{
"category": "description",
"text": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind9: Unexpected exit with NSEC and NSEC3 both present",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13204"
},
{
"category": "external",
"summary": "RHBZ#2504447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504447"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13204"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13204",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13204"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind9: Unexpected exit with NSEC and NSEC3 both present"
},
{
"acknowledgments": [
{
"names": [
"Pavel Valena"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-15816",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-06-10T19:21:21+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500889"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this flaw\u0027s impact as Important. Exploitation requires an attacker-controlled or spoofed DHCP server on the same network segment as a system performing network boot (root=dhcp/netroot=dhcp), and for the DHCP-supplied ROOT_PATH value to fail dracut\u0027s netroot handler resolution -- both fully within an adjacent-network attacker\u0027s control. Reaching the point where the poisoned hook script is actually sourced depends on dracut\u0027s boot-failure handling reinvoking the emergency shell mechanism, which occurs by default when the netroot handler cannot be resolved. This is a separate code path from CVE-2026-6893, which patched modules.d/35network-legacy/dhclient-script.sh but did not modify dracut-lib.sh\u0027s die() function. Systems that do not perform network/PXE boot, or that do not rely on DHCP-supplied ROOT_PATH values, are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15816"
},
{
"category": "external",
"summary": "RHBZ#2500889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15816"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816"
},
{
"category": "external",
"summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
},
{
"category": "external",
"summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh",
"url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh"
},
{
"category": "external",
"summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh",
"url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh"
}
],
"release_date": "2026-08-05T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"category": "workaround",
"details": "Restrict DHCP server access on networks used for network boot (DHCP snooping, dedicated/trusted provisioning VLANs) until a fix is available.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()"
},
{
"cve": "CVE-2026-43133",
"cwe": {
"id": "CWE-628",
"name": "Function Call with Incorrectly Specified Arguments"
},
"discovery_date": "2026-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467065"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s Kernel-based Virtual Machine (KVM) nSVM module. When a nested virtual machine (L2 guest) executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor (L1), KVM incorrectly uses `vmcb02` instead of `vmcb01` for managing guest state. This incorrect Virtual Machine Control Block (VMCB) handling could lead to unexpected behavior or state corruption within the virtualized environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43133"
},
{
"category": "external",
"summary": "RHBZ#2467065",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467065"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43133",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43133"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43133",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43133"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43133-ffea@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43133-ffea@gregkh/T"
}
],
"release_date": "2026-05-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation"
},
{
"cve": "CVE-2026-55973",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-07-20T21:57:00.775000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503075"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Unbound. When the \u0027dns-error-reporting: yes\u0027 option is enabled, a remote attacker can send a specially crafted DNS response containing a malformed EDNS Report-Channel option from a delegated zone they control. This can lead to a stack variable overwrite, causing the Unbound daemon to terminate. This vulnerability results in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in Unbound occurs when the `dns-error-reporting` option is explicitly enabled, allowing a remote attacker to terminate the daemon with a crafted DNS response. While several Red Hat products are affected, many Red Hat Enterprise Linux and OpenShift Container Platform versions are not vulnerable as the affected code is not present.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55973"
},
{
"category": "external",
"summary": "RHBZ#2503075",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503075"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55973",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55973"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55973",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55973"
},
{
"category": "external",
"summary": "https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2",
"url": "https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58014",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"discovery_date": "2026-06-24T17:16:25.796000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492255"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications loading or parsing untrusted key files, typically .desktop or .ini files, are vulnerable to this issue. This flaw can cause an off-by-one error, leading to an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58014"
},
{
"category": "external",
"summary": "RHBZ#2492255",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58014"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930"
}
],
"release_date": "2026-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\""
},
{
"acknowledgments": [
{
"names": [
"Thepwnisher"
]
}
],
"cve": "CVE-2026-58015",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-24T17:22:00.405000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be in a position to perform a man-in-the-middle (MitM) attack on the connection or operate a malicious server that the client connects to. Furthermore, extracting data requires an oracle attack (guessing and hashing), increasing the complexity of exploitation. However, if successful, this issue allows the exfiltration of sensitive secrets, such as SSH keys or API tokens, from the filesystem. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58015"
},
{
"category": "external",
"summary": "RHBZ#2492256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58015"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-72693",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2026-04-26T18:17:20+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2462115"
}
],
"notes": [
{
"category": "description",
"text": "`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in openvt (part of the kbd package) where incorrect process owner verification can allow a local unprivileged attacker to achieve passwordless root login. However, exploitation requires a non-default kbrequest/init configuration that explicitly invokes openvt -u, combined with a specific timing condition where TTY ownership has returned to root after logout while an unprivileged process still holds an open file descriptor to the TTY. This combination of prerequisites \u2014 a deliberately configured kbrequest/init setup and a narrow TTY-state race \u2014 is not present in standard Red Hat product deployments. For this reason, Red Hat rates the impact of this vulnerability as Moderate despite the high CVSS base score, which reflects only the technical worst-case impact and not the real-world exploitation constraints.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-72693"
},
{
"category": "external",
"summary": "RHBZ#2462115",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462115"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-72693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72693"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-72693",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72693"
}
],
"release_date": "2026-08-11T06:58:59.200000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T10:01:11+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:e74e45ada5ab6325586e559ea69b7fd23bfe620af960bef33af19cadea8db7d2\n\n (For s390x architecture)\n The image digest is\nsha256:347eda8880ab4c686d434f7c4283643e2dc24beb105921b056fbdb8bdd0846ac\n\n (For ppc64le architecture)\n The image digest is\nsha256:307f108a7f85343b693cb29ddc34cf96e7d059c118b460af0e988e0b3f80c407\n\n (For aarch64 architecture)\n The image digest is\nsha256:f15ec71d866b8cc0ee85d082f185822b418d002e76bea7bc2ae1cbff6e0abf56\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid using `openvt -u` in privileged `kbrequest`/init deployments. Instead, configure the keyboard request to initiate a standard authenticated login on the new virtual terminal, or disable the keyboard request binding entirely until a fix is available. Changes to `kbrequest` configurations may require a system restart or service reload to take effect.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202609081748-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202609081748-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…