Red Hat Security Advisory: OpenShift Container Platform 4.17.60 packages and security update

Fixed packages 20

Vulnerabilities 3

• High 7.5
  CVE-2026-33814

  Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

  When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.4
  CVE-2026-92092

  Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

  A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HT…

  Red Hat Red Hat OpenShift Container Platform 5 Red Hat OpenShift Container Platform 4.14 Red Hat OpenShift Container Platform 4.16
  Oct 29, 2026
• Medium 6.8
  CVE-2026-111943 Public exploit

  Distrust compromised intermediate certificates in crypto/x509

  On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io
  Oct 21, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2556068
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96281.json
• report
  https://access.redhat.com/security/cve/CVE-2026-33814
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33814
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33814
• article
  https://go.dev/cl/761581
• article
  https://go.dev/cl/761640
• article
  https://go.dev/issue/78476
• article
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• advisory
  https://pkg.go.dev/vuln/GO-2026-4918
• report
  https://access.redhat.com/security/cve/CVE-2026-92092
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-92092
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-92092
• report
  https://access.redhat.com/security/cve/CVE-2026-111943
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-012
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-111943
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-111943
• article
  https://github.com/golang/go/issues/82345
• article
  https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU
• advisory
  https://pkg.go.dev/vuln/GO-2026-6809