Red Hat Security Advisory: OpenShift Container Platform 4.15.71 packages and security update

Fixed packages 50

Vulnerabilities 6

• Critical 9.8
  CVE-2026-98432 Public exploit

  ipv4: free inet_opt and ireq_opt after an RCU grace period

  In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 15, 2026
• Critical 9.6
  CVE-2026-39821

  Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

  Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 22, 2026
• High 7.5
  CVE-2026-33814

  Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

  When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.4
  CVE-2026-92092

  Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

  A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HT…

  Red Hat Red Hat OpenShift Container Platform 5 Red Hat OpenShift Container Platform 4.14 Red Hat OpenShift Container Platform 4.16
  Oct 29, 2026
• Medium 6.8
  CVE-2026-111943 Public exploit

  Distrust compromised intermediate certificates in crypto/x509

  On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io
  Oct 21, 2026
• Medium 6.1
  CVE-2026-25681

  Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

  Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480756
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480761
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2556068
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95754.json
• report
  https://access.redhat.com/security/cve/CVE-2026-25681
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-25681
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-25681
• article
  https://go.dev/cl/781703
• article
  https://go.dev/issue/79574
• article
  https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• advisory
  https://pkg.go.dev/vuln/GO-2026-5029
• report
  https://access.redhat.com/security/cve/CVE-2026-33814
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33814
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33814
• article
  https://go.dev/cl/761581
• article
  https://go.dev/cl/761640
• article
  https://go.dev/issue/78476
• article
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• advisory
  https://pkg.go.dev/vuln/GO-2026-4918
• report
  https://access.redhat.com/security/cve/CVE-2026-39821
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-39821
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-39821
• article
  https://go.dev/cl/767220
• article
  https://go.dev/issue/78760
• advisory
  https://pkg.go.dev/vuln/GO-2026-5026
• report
  https://access.redhat.com/security/cve/CVE-2026-92092
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515862
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-92092
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-92092
• report
  https://access.redhat.com/security/cve/CVE-2026-98432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2553390
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-016
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-98432
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-98432
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-111943
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-012