Red Hat Security Advisory: OpenShift Virtualization v4.21 Images

CVE-2026-40898 is a denial-of-service vulnerability in quic-go, a QUIC protocol implementation in Go, where specially crafted HTTP/3 trailer fields cause excessive memory allocation. This can lead to resource exhaustion and crashes on affected Red Hat products that utilize quic-go for HTTP/3 communication. The vulnerability affects Red Hat Hardened Images and related RPMs, including caddy version 2.11.4-0.2.hum1 for aarch64 and x86_64 architectures. Red Hat has issued a security advisory (RHSA-2026:40223) with updated packages to fix this issue. No alternative mitigations are currently available or meet Red Hat's criteria for deployment.

The vulnerability allows remote attackers to cause a denial-of-service condition by exhausting system memory through crafted HTTP/3 trailer fields. This can result in server or client crashes or resource unavailability in affected Red Hat products using quic-go. The impact is high availability disruption without confidentiality or integrity loss.

Red Hat has released updated RPM packages including caddy-2.11.4-0.2.hum1 that address this vulnerability. Applying these updates is the recommended remediation. No other mitigations are currently available or recommended by Red Hat. Users should follow Red Hat's update instructions at https://images.redhat.com/ to apply the fix.