This Red Hat security advisory (RHSA-2026:2172) addresses multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.15 and related products. Notably, CVE-2024-34155 involves golang parser functions where calling any Parse function with deeply nested literals can cause a panic or stack exhaustion. CVE-2024-34156 similarly involves golang's encoding/gob Decoder.Decode function causing panic due to deeply nested structures. These issues can lead to denial of service conditions by exhausting stack resources. The advisory includes fixes for these and other CVEs and is rated as important/high severity by Red Hat. The vendor advisory confirms that updates are available and provides detailed instructions for applying the fixes. No evidence of known exploits in the wild is reported. The affected products include Red Hat OpenShift Data Foundation 4.15 and Red Hat OpenStack Platform 16.2 among others.

The vulnerabilities can cause application panics and stack exhaustion when processing deeply nested data structures, potentially leading to denial of service conditions in affected Red Hat products. This could disrupt normal operation of OpenShift Data Foundation and OpenStack Platform components. No known exploitation in the wild has been reported. The impact is rated as high severity by Red Hat Product Security.

Red Hat has released official security updates addressing these vulnerabilities. Users should apply the Red Hat OpenShift Data Foundation 4.15 update and ensure all previously released errata relevant to their systems are applied. Detailed update instructions are available in the Red Hat documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.15/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf and the advisory at https://access.redhat.com/errata/RHSA-2026:2172. No additional mitigation is required beyond applying the official patches.