This advisory covers security updates in Red Hat OpenShift Container Platform 4.18.42 that fix multiple vulnerabilities: CVE-2025-58183 (golang archive/tar unbounded allocation parsing GNU sparse map), CVE-2025-61726 (golang net/url memory exhaustion in query parameter parsing), CVE-2025-61728 (golang archive/zip excessive CPU consumption building archive index), CVE-2025-61729 (golang crypto/x509 denial of service via crafted certificate), CVE-2025-68121 (crypto/tls incorrect certificate validation during TLS session resumption), and CVE-2026-23490 (pyasn1 denial of service from malformed RELATIVE-OID). These vulnerabilities can cause denial of service or incorrect TLS validation. The advisory provides updated RPM packages and container images to address these issues. Red Hat rates the security impact as Important and recommends upgrading to these updated components.

The vulnerabilities fixed in this update can lead to denial of service conditions through memory exhaustion or excessive CPU consumption, potentially impacting availability. Additionally, one vulnerability involves incorrect certificate validation during TLS session resumption, which could affect the security of TLS connections. No known exploits in the wild have been reported. The overall security impact is rated Important by Red Hat.

Red Hat has released updated RPM packages and container images for OpenShift Container Platform 4.18.42 that address these vulnerabilities. Users should upgrade to these updated packages and images via the appropriate release channels using the OpenShift CLI or web console. Detailed upgrade instructions are available in Red Hat's official documentation. Patch status is confirmed as fixed in this release.