This advisory covers a security update for Red Hat OpenShift Container Platform 4.19.39, which addresses several vulnerabilities including CVE-2026-4890 (dnsmasq NSEC bitmap parsing infinite loop), CVE-2026-4891 (dnsmasq RRSIG rdlen underflow causing heap out-of-bounds read), CVE-2026-4892 (dnsmasq DHCPv6 CLID buffer overflow), CVE-2026-42009 (gnutls denial of service via DTLS packet reordering), CVE-2026-42010 (gnutls authentication bypass via NUL character in username), CVE-2026-4893 (dnsmasq ECS source validation bypass), CVE-2026-5260 (gnutls information disclosure via heap overread in RSA key exchange), CVE-2026-5450 (glibc heap buffer overflow in scanf with %mc format specifier), CVE-2026-42011 (gnutls security bypass due to incorrect name constraint handling), and CVE-2026-42013 (gnutls certificate validation bypass due to oversized Subject Alternative Name). The update includes container images and RPM packages. Red Hat provides upgrade instructions and advises users to update via OpenShift CLI or web console.

The vulnerabilities fixed in this update can lead to denial of service conditions, heap buffer overflows, authentication bypasses, information disclosure, and security bypasses in cryptographic validation. These issues affect core components used in OpenShift Container Platform, potentially impacting cluster stability, security, and confidentiality if exploited. The advisory rates the security impact as Important, with a high severity for CVE-2026-4890 (dnsmasq NSEC bitmap parsing infinite loop) having a CVSS vector indicating network attack vector, low attack complexity, no privileges or user interaction required, and causing high availability impact.

Red Hat has released updated container images and RPM packages for OpenShift Container Platform 4.19.39 that address these vulnerabilities. Users should upgrade their OpenShift clusters to these updated versions as soon as they become available in the appropriate release channels. Upgrades can be performed using the OpenShift CLI (oc) or the web console. Detailed upgrade instructions are provided in the official Red Hat documentation. No additional mitigations are indicated beyond applying the official update.