Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.72. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:77319
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes
Multiple vulnerabilities were discovered in PyJWT affecting key validation and handling, potentially allowing attackers to forge authentication tokens or disclose sensitive information. These issues involve improper validation of JWK keys during HMAC verification, incorrect handling of redirects when fetching key sets, and improper recognition of certain PEM and DER public key formats. The vulnerabilities affect PyJWT versions prior to 2.13.0-1ubuntu1 and specific listed versions. Ubuntu has released a fixed package version 2.13.0-1ubuntu1 to address these issues.
Red Hat OpenShift Container Platform 4.13.72 is a Kubernetes application platform for on-premise or private cloud deployments. This advisory announces the availability of updated RPM packages and container images for version 4.13.72. The update addresses several bugs but contains no security fixes. Users are advised to upgrade to these updated packages and images when available. The advisory references CVE-2026-33814 but states no security fixes are included in this release. Instructions for upgrading clusters are provided by Red Hat.
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the Table Designer 'data-label' attribute. This vulnerability exists in all versions up to and including 1.27.13 and allows authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The CVSS score is 6.4, indicating a medium severity risk.
A denial of service vulnerability exists in FasterXML Jackson 1.x, specifically in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13. The vulnerability is triggered by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue. This can cause the application to become unresponsive or crash.
Nodemailer versions 3.0.0 before 10.0.13 contain a regular expression denial of service (ReDoS) vulnerability in the SMTPConnection._actionEHLO function. This vulnerability arises from overlapping whitespace sub-patterns in four AUTH mechanism detection regexes, causing quadratic backtracking. A malicious or man-in-the-middle SMTP server can exploit this by sending a crafted EHLO response with a long whitespace run and a non-matching token, which blocks the Node.js event loop for an extended period, potentially from tens of seconds to hours.
Nodemailer versions from 3.0.0 up to but not including 10.0.13 have an improper input validation vulnerability in the address parser. This flaw allows RFC 5322 comments inside angle-bracket email addresses to remain unstripped, enabling attackers to craft recipient addresses with parenthesized comments in the domain part. Such malformed addresses can cause delivery rejection or parser conflicts that may bypass domain allow-lists. The issue is fixed in version 10.0.13.
CVE-2026-110831 is a resource retention vulnerability in FreeRDP versions 3.13.0 up to but not including 3.32.0. The flaw occurs in the drive_process_irp_create function, where a file descriptor or handle is registered before allocation size is applied and not removed if the operation fails. This can be exploited by a malicious RDP server sending a crafted IRP_MJ_CREATE request with an allocation size of UINT64_MAX, causing a failure that leaks the file object and OS handle until the drive is torn down.
CVE-2026-85714 is a critical code injection vulnerability in Stirling-Tools Stirling-PDF versions prior to 2.13.2. An authenticated administrator using the default H2 database and security mode can upload a crafted SQL file that bypasses input validation, enabling execution of dangerous H2 functions. This leads to arbitrary file access and ultimately allows operating-system command execution as the JVM service account. The issue is fixed in version 2.13.2.
CVE-2026-104103 is a path traversal vulnerability in ludwig-ai's ludwig framework prior to version 0.17.8. The flaw exists in the extract_archive() function, which improperly validates symlink and hard-link members in tar archives, allowing crafted archives to write files outside the intended extraction directory. This can lead to attacker-controlled content being placed at arbitrary filesystem paths with the privileges of the extracting process. The issue affects Python 3.12 and 3.13 runtimes but not Python 3.14, which rejects such escaping links by default. The vulnerability is fixed in version 0.17.8.
CVE-2026-108395 is a high-severity vulnerability in the Model Context Protocol Java SDK affecting multiple versions of the io.modelcontextprotocol.sdk:mcp artifact and mcp-core. The issue arises because certain server transports read HTTP request bodies into memory without enforcing a maximum size limit. This allows an unauthenticated remote attacker to send arbitrarily large POST requests, potentially exhausting the Java process heap and causing denial of service. The vulnerability affects versions from 0.8.0 up to but not including 0.13.0, from 0.13.0 up to 0.18.4, from 1.0.0 up to 1.1.4, and from 2.0.0-M1 up to 2.0.1. Fixed versions are 0.18.4, 1.1.4, and 2.0.1. Mitigations include authentication, origin or host validation, or upstream request size limits to reject malicious requests before they reach the vulnerable code.
CVE-2026-105659 is a high-severity uncontrolled resource consumption vulnerability in the mtrudel bandit HTTP/2 implementation. It allows an unauthenticated remote attacker to keep HTTP/2 stream processes pinned indefinitely by sending a trickle of small WINDOW_UPDATE frames. This behavior causes server processes and memory to be exhausted by maintaining blocked streams and their associated resources. The vulnerability affects bandit versions from 1.4.0 up to but not including 1.13.0.
CVE-2026-77564 is a vulnerability in Talos Linux versions prior to 1.12.9 and between 1.13.0 and before 1.13.3 where sensitive authentication information is stored in cleartext within support bundles generated by talosctl. This can lead to unintended disclosure of private registry credentials if support bundles are shared improperly. Versions 1.12.9 and 1.13.3 and later fix this issue by redacting sensitive data. Talos 1.14 and later also encrypt support bundles by default, further reducing exposure risk.
CVE-2026-67418 is a medium severity vulnerability in rabbitmq-server affecting MQTT 5 parser versions from 3.13.0 up to but not including 3.13.19, and several 4.x versions before specified patch releases. It involves improper validation of the Request-Problem-Information property in PUBLISH packets, which is only valid for CONNECT packets. An authenticated publisher with topic write permission can cause a subscriber's MQTT or Web MQTT connection to close unexpectedly due to an unhandled exception during serialization. The broker and publisher remain available, and no denial of service beyond connection closure or message replay occurs. Fixed versions are 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
CVE-2026-110658 is a heap out-of-bounds read vulnerability in sofia-sip up to version 1.13.18. It occurs in the msg_multipart_parse() function when processing multipart MIME boundaries. An unauthenticated remote attacker can send an INVITE request with a multipart Content-Type header containing a boundary string longer than the message body, causing a memory read beyond the allocated heap buffer and crashing the process. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).