Red Hat Security Advisory: OpenShift Container Platform 4.22.11 bug fix and security update

This advisory covers security updates in Red Hat OpenShift Container Platform 4.22.11 that fix several vulnerabilities: CVE-2026-11622 addresses potential memory usage beyond configured limits in bind9; CVE-2026-11721 involves cache poisoning via label count discrepancy, RRSIG, and wildcards in bind9; CVE-2026-13204 concerns unexpected exit when NSEC and NSEC3 are both present in bind9; CVE-2026-13321 is a DNSSEC validation bypass via out-of-zone NSEC Next Field in bind9; and CVE-2026-64531 fixes an issue in the kernel's openvswitch module rejecting oversized nested action attributes. The update is rated as having an Important security impact by Red Hat Product Security. Users should upgrade using the OpenShift CLI or web console following official upgrade instructions.

The vulnerabilities fixed in this update could lead to denial of service conditions (e.g., unexpected process exits or memory exhaustion), cache poisoning attacks affecting DNS integrity, and bypass of DNSSEC validation, potentially undermining DNS security. The kernel vulnerability could allow malformed network packets to cause instability or other unintended behavior in the openvswitch module. These issues collectively pose a high risk to the security and stability of OpenShift Container Platform deployments if left unpatched.

Red Hat has released OpenShift Container Platform 4.22.11 containing fixes for these vulnerabilities. Users running versions >=4.22.0 and <4.22.11 should upgrade to 4.22.11 as soon as it is available in their release channel. Upgrades can be performed using the OpenShift CLI (oc) or web console. Detailed upgrade instructions are provided in the official Red Hat documentation. No additional mitigation steps are indicated beyond applying this update.