A vulnerability (CVE-2026-27141) was identified in the golang.org/x/net/http2 package used by Red Hat OpenShift Pipelines Operator. The issue is a null pointer dereference triggered by processing malformed HTTP/2 frames (frame types 0x0a through 0x0f), which can cause the server to crash, resulting in a denial of service condition. This affects OpenShift Pipelines Operator versions >=1.21.0 and <1.21.2. Red Hat released version 1.21.2 to fix this issue along with other bugs. The vulnerability is categorized under CWE-476 (NULL Pointer Dereference) and related CWEs. No public exploits are known. Red Hat rates this vulnerability as high severity and provides official fixes in the 1.21.2 release.

The vulnerability can be exploited remotely by sending malformed HTTP/2 frames to the affected server, causing a null pointer dereference and server crash. This results in a denial of service, making the affected OpenShift Pipelines Operator unavailable to legitimate users. There is no indication of confidentiality or integrity impact. No known active exploitation has been reported.

Red Hat has released OpenShift Pipelines Operator version 1.21.2 which includes a fix for this vulnerability. Users should upgrade to version 1.21.2 or later to remediate the issue. No effective mitigation other than upgrading is currently available or meets Red Hat's criteria for ease of use and applicability. Users should consult the Red Hat advisory RHSA-2026:26519 for detailed guidance.