CVE-2026-4800 is a denial of service vulnerability in the Go crypto/x509 package used by Red Hat OpenShift GitOps. It occurs during validation of certificate chains containing a large number of policy mappings, leading to excessive CPU and memory consumption. Exploitation requires presenting a specially crafted, yet trusted, certificate chain, which implies prior compromise of a trusted root certificate. Red Hat has released an update to OpenShift GitOps v1.19.4 that addresses this and other issues, including removal of a persistent Service-CA annotation introduced in earlier versions. The advisory references multiple CVEs and provides detailed remediation instructions.

The vulnerability can cause denial of service by consuming excessive platform resources during certificate validation, potentially degrading or disrupting service availability. Since exploitation requires a trusted certificate chain, the risk is limited to scenarios where an attacker has compromised a trusted root certificate. No confidentiality or integrity impacts are reported. No known exploits in the wild have been observed. The update mitigates these issues by fixing the inefficient validation process and related bugs.

An official security update is available in Red Hat OpenShift GitOps version 1.19.4. Users should apply this update after ensuring all previously released errata are applied. No alternative mitigations meeting Red Hat's criteria are currently available. The vendor manages remediation through this update, and no additional action is required beyond applying the patch.