Threats Tagged 'cve-2026-34986'

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.4. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:34789 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/

Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The multicluster engine for Kubernetes v2.8 images The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

This update includes the following RPMs: nodejs26: * nodejs26-26.3.0-1.2.hum1 (aarch64, x86_64) * nodejs26-bin-26.3.0-1.2.hum1 (noarch) * nodejs26-devel-26.3.0-1.2.hum1 (aarch64, x86_64) * nodejs26-docs-26.3.0-1.2.hum1 (noarch) * nodejs26-full-i18n-26.3.0-1.2.hum1 (aarch64, x86_64) * nodejs26-libs-26.3.0-1.2.hum1 (aarch64, x86_64) * nodejs26-npm-11.16.0-1.26.3.0.1.2.hum1 (noarch) * nodejs26-npm-bin-26.3.0-1.2.hum1 (noarch) * v8-14.6-devel-14.6.202.34-1.26.3.0.1.2.hum1 (aarch64, x86_64) * nodejs26-26.3.0-1.2.hum1.src (src)

Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.29 release is based on Eclipse Che 7.119 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw

Red Hat OpenShift Container Platform 4.20.25 includes a security update addressing multiple vulnerabilities. The update fixes bugs and adds enhancements to improve platform stability and security. The advisory covers container images and directs users to upgrade their clusters using official channels. The vulnerabilities have been rated with high severity based on CVSS metrics, indicating potential for significant impact on confidentiality, integrity, and availability. Users of OpenShift Container Platform 4.20 are advised to apply the update promptly.