SB2026100215 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
Published: October 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-4890)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in NSEC bitmap parsing in dnssec.c when processing crafted DNSSEC NSEC or NSEC3 records. A remote attacker can send a specially crafted DNS response to cause a denial of service.
No valid DNSSEC signatures are needed because the issue is reachable before RRSIG validation.
2) Input validation error (CVE-ID: CVE-2026-4891)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in RRSIG packet handling in dnssec.c when processing crafted RRSIG records with an undersized rdlen value. A remote attacker can send a specially crafted DNS response to cause a denial of service.
3) Stack-based buffer overflow (CVE-ID: CVE-2026-4892)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to stack-based buffer overflow in helper.c when processing oversized DHCPv6 CLIDs for the --dhcp-script helper path. A remote attacker can send a specially crafted DHCPv6 client identifier to execute arbitrary code.
Only configurations with --dhcp-script enabled are vulnerable, and the helper process retains root privileges.
4) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-42009)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper implementation of a qsort comparator contract in the DTLS packet sequence number comparator when ordering DTLS packets by sequence numbers. A remote attacker can send DTLS packets with duplicate sequence numbers to cause a denial of service.
5) Improper Authentication (CVE-ID: CVE-2026-42010)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to improper authentication in RSA-PSK username matching when processing usernames containing a NUL character. A remote attacker can supply a specially crafted username to bypass authentication.
6) Input validation error (CVE-ID: CVE-2026-4893)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass client subnet source validation.
The vulnerability exists due to improper input validation in check_source() handling in process_reply() when processing DNS replies with the --add-subnet feature enabled. A remote attacker can send a specially crafted DNS reply to bypass client subnet source validation.
Only configurations with --add-subnet enabled are vulnerable.
7) Out-of-bounds read (CVE-ID: CVE-2026-5260)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in RSA key exchange handling when processing an extremely short premaster secret from a client for a server using an RSA key backed by a PKCS#11 token. A remote attacker can send a specially crafted premaster secret to disclose sensitive information.
Only servers using an RSA key backed by a PKCS#11 token are vulnerable.
8) Heap-based buffer overflow (CVE-ID: CVE-2026-5450)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
9) Improper Certificate Validation (CVE-ID: CVE-2026-42011)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass name constraints during certificate validation.
The vulnerability exists due to improper certificate validation in the name constraints handling logic when processing certificate chains. A remote attacker can present a specially crafted certificate chain to bypass name constraints during certificate validation.
The issue occurs when permitted name constraints are ignored if prior certificate authorities contain only excluded name constraints.
10) Improper Certificate Validation (CVE-ID: CVE-2026-42013)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate hostname validation.
The vulnerability exists due to improper certificate validation in certificate Subject Alternative Name and Common Name hostname checking when validating certificates with oversized Subject Alternative Names. A remote attacker can present a specially crafted certificate to bypass certificate hostname validation.
Remediation
Install update from vendor's website.