Red Hat Security Advisory: OpenShift Container Platform 4.16.74 packages and security update

Fixed packages 45

Vulnerabilities 3

• High 7.8
  CVE-2026-62146 Public exploit

  Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket

  A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-si…

  Red Hat Red Hat OpenShift Container Platform 5 Red Hat OpenShift Container Platform 4.16 cri-o Azure Linux
  Sep 30, 2026
• High 7.5
  CVE-2026-33814

  Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

  When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 6.8
  CVE-2026-111943 Public exploit

  Distrust compromised intermediate certificates in crypto/x509

  On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io
  Oct 21, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2499618
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89713.json
• report
  https://access.redhat.com/security/cve/CVE-2026-33814
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33814
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33814
• article
  https://go.dev/cl/761581
• article
  https://go.dev/cl/761640
• article
  https://go.dev/issue/78476
• article
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• advisory
  https://pkg.go.dev/vuln/GO-2026-4918
• report
  https://access.redhat.com/security/cve/CVE-2026-62146
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-62146
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-62146
• article
  https://github.com/cri-o/cri-o/security/advisories/GHSA-6wmc-5877-hgc9
• report
  https://access.redhat.com/security/cve/CVE-2026-111943
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2556068
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-012
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-111943
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-111943
• article
  https://github.com/golang/go/issues/82345
• article
  https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU
• advisory
  https://pkg.go.dev/vuln/GO-2026-6809