Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update

FIXED BUGS:
==========
DFBUGS-9792: Use Azure Storage Account GPv2
DFBUGS-9382: [Backport to odf-4.16.z] [Backport to 4.22] Backport CA related fixes for NooBaa 
DFBUGS-7335: [Backport to odf-4.16.z] [5.20] Update nodejs from v22.11.0 to v24.13.0
DFBUGS-7030: [Backport to odf-4.16.z] [GSS] noobaa DB grows  with errors BlockStoreAzure _delete_blocks failed for block

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.54. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2026:57482

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.18.54 bug fix and security update

Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused
management of edge devices and applications. It supports image-mode RHEL and
container workloads that run on Podman/Docker or Kubernetes.

RHEM is now available as a standalone feature, providing greater flexibility for
edge deployments. In addition to the standalone version, RHEM continues to be
offered as a plugin for the following platforms:

* Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge
devices.
* Red Hat Ansible Automation Platform (AAP): Integrates edge management with
Ansible automation.

This integration enables organizations to optimize the management and
orchestration of their fleets of edge devices; whether its thousands of
dispersed retail point-of-sale systems or industrial machinery on remote factory
floors.

Value for customers and partners:

* This solution not only helps customers manage thousands of devices but helps
scale operations.
* To manage large-scale deployments, customers need to be able to integrate with
their existing management systems, support remote configuration and over-the-air
updates, and collect telemetry data for advanced analytics.
* Red Hat Edge Manager offers a simple and security-focused lifecycle
management, from onboarding to decommissioning of edge devices.

This complete end-to-end solution empowers organizations to gain the most value
from the fleets of devices that generate data, all from a centralized location.

Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update

Red Hat Advanced Cluster Management for Kubernetes 2.14 images

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.14/html-single/release_notes/index#acm-release-notes

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update

Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update

HawtIO 4.4.0 for Red Hat build of Apache Camel 4 GA Release is now available.

The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.

* spring boot: Remote code execution via timing attack in DevTools remote secret comparison [CVE-2026-40972]

* axios: Invisible JSON Response Tampering via Prototype Pollution Gadget [CVE-2026-42044]

* spring-boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory [CVE-2026-40973]

* io.hawt-project: fast-uri: Path traversal vulnerability allows bypass of security policies [CVE-2026-6321]

* axios: Authentication bypass due to prototype pollution of HTTP error handling [CVE-2026-42041]

* axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data [CVE-2026-42039]

* axios: NO_PROXY bypass via crafted URL [CVE-2026-42043]

* axios: HTTP Transport Hijacking via Prototype Pollution [CVE-2026-42033]

* spring-boot: Weak pseudo-random number generation can lead to information disclosure. [CVE-2026-40975]

* io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests [CVE-2026-39852]

* jetty-ee10-webapp: early return from the JASPIAuthenticator class without clearing ThreadLocal variables [CVE-2026-5795]

* jetty-ee10-servlet: early return from the JASPIAuthenticator class without clearing ThreadLocal variables [CVE-2026-5795]

* spring-boot: Authentication bypass via misconfigured Health Group additional path [CVE-2026-22731]

* jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests [CVE-2026-1605]

* vertx-core: static handler component cache can be manipulated to deny the access to static files [CVE-2026-1002]

* io.hawt-project: prototype pollution in _.unset and _.omit functions [CVE-2025-13465]

* hawtio-operator-container: golang: Denial of Service due to excessive resource consumption via crafted certificate [CVE-2025-61729]

* hawtio-operator-container: Memory exhaustion in query parameter parsing in net/url [CVE-2025-61726]

* axios:Arbitrary HTTP header injection via prototype pollution [CVE-2026-42035]

* jetty-http: HTTP request smuggling via chunked extension quoted-string parsing [CVE-2026-2332]

* hawtio-operator-container: Go: Denial of Service vulnerability in certificate chain building [CVE-2026-32280]

* hawtio-operator-container: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application [CVE-2026-33810]

* hawtio-operator-container: Go crypto/x509: Denial of Service via inefficient certificate chain validation [CVE-2026-32281]

* hawtio-operator-container: Root.Chmod can follow symlinks out of the root [CVE-2026-32282]

Red Hat Security Advisory: HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.16.63. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2026:20086

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.16.63 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.64. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2026:14772

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.15.64 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.14.65. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2026:15086

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.14.65 bug fix and security update

See the release notes (link in the references section) for a
description of the fixes and enhancements in this particular release.

Red Hat Security Advisory: RHACS 4.10.2 security and bug fix update

Red Hat Advanced Cluster Management for Kubernetes 2.15 images

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html-single/release_notes/index#acm-release-notes

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.2 security update

The multicluster engine for Kubernetes v2.10 images

The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.

You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.

Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.2 security update

The multicluster engine for Kubernetes v2.9 images

The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.

You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.

Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.3 security update

The Red Hat multicluster engine for Kubernetes v2.6 images provide centralized management for multiple Kubernetes clusters across various environments. A security advisory (RHSA-2026:9848) addresses multiple vulnerabilities including CVE-2025-13465 and others. The advisory updates the engine to version 2.6.10 with security fixes and enhancements. The engine enables creation and management of OpenShift Container Platform clusters and configuration distribution via APIs. No explicit affected versions or fixed versions are detailed in the advisory content provided.

Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.10 security update

Red Hat Advanced Cluster Management for Kubernetes 2.13 images

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html-single/release_notes/index#acm-release-notes

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.6 security update

The multicluster engine for Kubernetes v2.8 images

The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.

You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.

Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.5 security update

Red Hat Security Advisory: Red Hat Quay 3.16.3

Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development.
The 3.27 release is based on Eclipse Che 7.115 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2.
Users still using the v1 standard should migrate as soon as possible.
https://devfile.io/docs/2.2.0/migrating-to-devfile-v2
Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates.
https://access.redhat.com/support/policy/updates/openshift#crw

Search: CVE-2025-13465