SB20260720393 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
Published: July 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-12151)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket client message fragmentation handling when processing fragmented WebSocket messages from a server. A remote attacker can send many small or empty continuation frames to cause a denial of service.
Exploitation requires the application to connect to an attacker-controlled or compromised WebSocket endpoint using the WebSocket client or the WebSocketStream API.
2) Inefficient regular expression complexity (CVE-ID: CVE-2026-26996)
CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions within "minimatch" function. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
3) Prototype pollution (CVE-ID: CVE-2026-29063)
CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to modify object prototype attributes in affected JavaScript objects.
The vulnerability exists due to improper input validation in the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() functions when processing user-supplied input containing __proto__ properties. A remote attacker can send a specially crafted object input to pollute the prototype of base objects, leading to unauthorized property injection and potential privilege escalation.
Prototype pollution occurs without affecting the global Object.prototype, but injected properties can still be accessed through object property lookups even if not visible via Object.keys().
4) Improper Authorization (CVE-ID: CVE-2026-33186)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to gain access to bypass authorization.
The vulnerability exists due to authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server to bypass authorization.
5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-35469)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Code Injection (CVE-ID: CVE-2026-4800)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in _.template when processing untrusted options.imports key names. A remote attacker can supply crafted imports key names to execute arbitrary code.
Code execution occurs at template compilation time. If Object.prototype has been polluted by another vector, inherited polluted keys can also be copied into the imports object and passed to Function().
7) Improper Certificate Validation (CVE-ID: CVE-2026-9697)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to intercept and modify HTTPS traffic.
The vulnerability exists due to improper certificate validation in ProxyAgent and Socks5ProxyAgent when establishing HTTPS connections through a SOCKS5 proxy. A remote attacker can present a certificate signed by a publicly trusted CA for the target hostname to intercept and modify HTTPS traffic.
Only applications that rely on requestTls settings for TLS scope restriction when using a SOCKS5 proxy are affected.
Remediation
Install update from vendor's website.