SB20261007245 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.22
Published: October 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-63385)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass access controls.
The vulnerability exists due to inconsistent interpretation of HTTP requests in evhttp_decode_uri_internal when processing percent-encoded URIs. A remote attacker can send a specially crafted request containing a %00 sequence to bypass access controls.
The issue arises because a decoded NUL byte can truncate the path for subsequent C string operations.
2) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80844)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an out-of-bounds memory access.
The vulnerability exists due to improper validation of routing header segments_left values in ipv6_rearrange_rthdr() when processing raw IPv6 HDRINCL packets with a segments_left value larger than the number of addresses described by hdrlen. A local user can send a crafted packet with an oversized segments_left value to cause an out-of-bounds memory access.
3) Integer underflow (CVE-ID: CVE-2026-81000)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write packet data outside allocated memory.
The vulnerability exists due to an integer underflow in TUN and TAP interface handling in tun_get_user() when processing an oversized headroom request propagated by an OVS port. A local user can configure an OVS port to propagate an oversized headroom request to a TUN or TAP device to write packet data outside allocated memory.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-81634)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to improper buffer length validation in the RRSet canonicalisation routine when processing a 255-length query name with a large TCP response. A remote attacker can provide a crafted DNS response to cause memory corruption.
Canonicalisation occurs before DNSSEC validation.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-82717)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in the CNAME synthesis packet-buffer handling logic when processing a crafted upstream DNS response that requires max TTL rewriting. A remote attacker can send a specially crafted upstream DNS response to execute arbitrary code.
Successful code execution depends on the system configuration, compilation options, and heap memory layout.
6) Out-of-bounds read (CVE-ID: CVE-2026-89846)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in qla2x00_status_entry() in the qla2xxx SCSI driver when processing an FCP response containing an oversized response information length. A remote attacker can send a crafted FCP response with an oversized rsp_info_len value to disclose sensitive information.
Remediation
Install update from vendor's website.