Red Hat Security Advisory: OpenShift Container Platform 4.22.9 packages and security update

Fixed packages 8

Vulnerabilities 2

• High 7.5
  CVE-2026-46597

  Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

  An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

  golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 5.3
  CVE-2026-39835

  Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

  SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

  golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480678
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480680
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51036.json
• report
  https://access.redhat.com/security/cve/CVE-2026-39835
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-39835
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-39835
• article
  https://go.dev/cl/781660
• article
  https://go.dev/issue/79563
• article
  https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• advisory
  https://pkg.go.dev/vuln/GO-2026-5015
• report
  https://access.redhat.com/security/cve/CVE-2026-46597
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46597
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46597
• article
  https://go.dev/cl/781620
• article
  https://go.dev/issue/79561
• advisory
  https://pkg.go.dev/vuln/GO-2026-5013