Multiple security vulnerabilities affect the tkn-fips package. These issues are resolved in later releases. See references for individual vulnerability details.
Multiple security vulnerabilities have been identified in the fulcio package. These vulnerabilities are addressed in version 1.8.2-r0. No specific details about the nature of the vulnerabilities or their impact are provided in the available data. There are no known exploits in the wild related to these issues. Users of fulcio should upgrade to version 1.8.2-r0 to mitigate these vulnerabilities.
Multiple security vulnerabilities affect the ip-masq-agent package, including CVE-2024-7598. These issues have been addressed in later releases of the software. The vulnerabilities relate to concurrency issues as indicated by CWE-362. No known exploits are reported in the wild. A patch is available to remediate these vulnerabilities.
Multiple security vulnerabilities were identified in the gpu-operator package. These issues have been addressed and fixed in version 25.10.0-r1. No CVSS score is provided, and no known exploits are reported in the wild. Users should update to the fixed version to remediate the vulnerabilities.
Multiple security vulnerabilities have been identified in the Apache Zookeeper package, specifically affecting version 3.8.6-r1. These issues involve the Netty network application framework used by Zookeeper. Security fixes addressing CVE-2026-42583 and related vulnerabilities have been applied in versions 3.8.6-r0 and 3.8.6-r1.
Multiple security vulnerabilities have been identified in the elastic-beats package, specifically affecting version 9.1.10-r0. These vulnerabilities have been addressed in later releases. No CVSS score is provided, and there are no known exploits in the wild at this time.
Multiple security vulnerabilities have been identified in the Apache Zookeeper package. These vulnerabilities have been addressed and fixed in versions 3.9.4-r0 and 3.9.4-r6. The issues affect the apache-zookeeper package and are resolved in these later releases. No specific technical details or CVSS scores are provided for the individual vulnerabilities. There are no known exploits in the wild at this time.
A security vulnerability was identified in the lvm-driver package affecting version 1.8.1-r2. The issue has been addressed in later releases of the package. No CVSS score or detailed technical impact information is provided.
A security vulnerability was identified in the modelmesh-runtime-adapter package. The issue has been addressed and fixed in version 0.12.0-r3. No CVSS score or detailed technical impact information is provided. There are no known exploits in the wild related to this vulnerability.
CVE-2026-42505 is a medium severity vulnerability affecting multiple versions of the golang-1.10 package and related Ubuntu and SUSE packages. It involves the potential de-anonymization of handshakes using Encrypted Client Hello due to disclosure of pre-shared key identities. Multiple security issues were fixed in the tekton-cli-0.46.0-1.1 package on openSUSE Tumbleweed, addressing these vulnerabilities. A patch is available to remediate the issues.
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)
* golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in the Pdm MessagePack for Python library prior to version 1.2.1 allows an out-of-bounds read and process crash when the Unpacker object is reused after an error occurs. This can lead to denial-of-service (DoS) conditions if untrusted input is repeatedly unpacked. The issue is fixed in version 1.2.1. Users should avoid reusing the same Unpacker after an error and instead create a new one to prevent crashes.
Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* python3.12-pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image (CVE-2026-25990)
* candlepin: com.mchange/c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects (CVE-2026-27830)
* dynflow-utils: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
Multiple security vulnerabilities affecting the cosign tool and related Go cryptography libraries have been identified and fixed. These include issues parsing HTML files, a memory-safety vulnerability, and multiple issues in golang.org/x/crypto/ssh. The vulnerabilities have been addressed in updated versions provided by SUSE and Red Hat. A patch is available to remediate these issues.
Multiple security vulnerabilities affect the management-api-for-apache-cassandra-5.0 package, including issues resolved in later releases. These vulnerabilities include request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values and denial of service via HTTP/2 CONTINUATION frame flood, among others. The vulnerabilities have been addressed in updated versions of the software. No known exploits are reported in the wild. Users are advised to apply the available patches to mitigate these issues.
A vulnerability exists in the idna.encode() function of the kimi-cli package used by python-pip, allowing specially crafted inputs to bypass a previous fix and cause excessive resource consumption leading to potential denial-of-service. This issue is due to insufficient early rejection of overly long inputs. Versions prior to 3.14 lack the improved input length checks. The vulnerability has a medium severity with a CVSS score of 5.3. Official patches addressing this issue are available starting from version 3.14.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.19.48. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:68540
Security Fix(es):
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.