Red Hat Security Advisory: OpenShift Virtualization v4.21 Images
Affects Red HatSource GCVE Database
Not known to be exploited.
Data as of 31 Oct 2026, 20:20 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 33% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 11 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 31 Oct 2026.
What to do
AI-suggested
Currently, no mitigation is available or meets Red Hat Product Security criteria for ease of use, applicability, and stability. Users should ensure all previously released errata are applied. Monitor Red Hat advisories for future updates or fixes. If possible, consider limiting exposure of affected services to untrusted networks until a fix is available.
Description
CVE-2026-40898 is a denial-of-service vulnerability in quic-go, an implementation of the QUIC protocol in Go, used by Red Hat OpenShift Virtualization v4.21 images. A remote attacker can send specially crafted HTTP/3 trailer fields to cause excessive memory allocation, potentially crashing the affected server or client or exhausting system resources. No mitigation is currently available that meets Red Hat's criteria for ease of use and stability. Red Hat has released updated OpenShift Virtualization v4.21 images that address various bugs and enhancements, but no specific fix for this vulnerability is indicated in the advisory.