CVE-2026-4800 affects Red Hat OpenShift Data Foundation versions >=4.16.0 <4.16.26 through a flaw in the fast-xml-parser library. An attacker can craft XML input containing numeric character references or standard XML entities that bypass configured entity expansion limits, causing excessive resource consumption (memory and CPU). This leads to a denial of service by crashing the affected process. Red Hat has issued an update in version 4.16.26 that fixes this vulnerability. The issue is tracked under CWE-776 (Improper Restriction of Recursive Entity References in DTDs). No mitigations other than upgrading meet Red Hat's criteria for ease of use and applicability. No active exploitation has been reported. The advisory references Red Hat's errata RHSA-2026:17549 and related CVE-2026-33036 for a similar issue in the fast-xml-parser.

The vulnerability allows remote attackers to cause a denial of service by supplying crafted XML input that bypasses entity expansion limits, leading to excessive memory allocation and CPU usage. This can crash the affected process running the vulnerable fast-xml-parser component within Red Hat OpenShift Data Foundation. There is no reported impact on confidentiality or integrity, only availability is affected. No known exploits in the wild have been reported.

Red Hat has released OpenShift Data Foundation version 4.16.26 which includes a fix for this vulnerability. Users should upgrade to this version or later to remediate the issue. Red Hat states that other mitigation options are either unavailable or do not meet their criteria for effective deployment and stability. Applying all previously released errata relevant to the system before updating is recommended. No additional mitigations are advised by Red Hat.