{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.22.11 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\n This release includes a security update for Red Hat OpenShift Container\nPlatform 4.22.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.22.11. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHSA-2026:57361\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nSecurity Fix(es):\n\n* bind: bind9: Potential memory usage beyond configured limits\n(CVE-2026-11622)\n* bind: bind9: Cache poisoning via label count discrepancy, RRSIG,\nwildcards (CVE-2026-11721)\n* bind: bind9: Unexpected exit with NSEC and NSEC3 both present\n(CVE-2026-13204)\n* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field\n(CVE-2026-13321)\n* kernel: net: openvswitch: reject oversized nested action attrs\n(CVE-2026-64531)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:57362",
        "url": "https://access.redhat.com/errata/RHSA-2026:57362"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2504166",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504166"
      },
      {
        "category": "external",
        "summary": "2504298",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504298"
      },
      {
        "category": "external",
        "summary": "2504338",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504338"
      },
      {
        "category": "external",
        "summary": "2504447",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504447"
      },
      {
        "category": "external",
        "summary": "2507402",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507402"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57362.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.22.11 bug fix and security update",
    "tracking": {
      "current_release_date": "2026-09-01T12:57:18+00:00",
      "generator": {
        "date": "2026-09-01T12:57:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:57362",
      "initial_release_date": "2026-08-25T13:48:35+00:00",
      "revision_history": [
        {
          "date": "2026-08-25T13:48:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-25T13:48:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-01T12:57:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.22",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.22",
                  "product_id": "9Base-RHOSE-4.22",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.22::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-aarch64-4.22.9.8.202608191915-0",
                "product": {
                  "name": "rhcos-aarch64-4.22.9.8.202608191915-0",
                  "product_id": "rhcos-aarch64-4.22.9.8.202608191915-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608191915?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-ppc64le-4.22.9.8.202608191915-0",
                "product": {
                  "name": "rhcos-ppc64le-4.22.9.8.202608191915-0",
                  "product_id": "rhcos-ppc64le-4.22.9.8.202608191915-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608191915?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-s390x-4.22.9.8.202608191915-0",
                "product": {
                  "name": "rhcos-s390x-4.22.9.8.202608191915-0",
                  "product_id": "rhcos-s390x-4.22.9.8.202608191915-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608191915?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-x86_64-4.22.9.8.202608191915-0",
                "product": {
                  "name": "rhcos-x86_64-4.22.9.8.202608191915-0",
                  "product_id": "rhcos-x86_64-4.22.9.8.202608191915-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608191915?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-aarch64-4.22.9.8.202608191915-0 as a component of Red Hat OpenShift Container Platform 4.22",
          "product_id": "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0"
        },
        "product_reference": "rhcos-aarch64-4.22.9.8.202608191915-0",
        "relates_to_product_reference": "9Base-RHOSE-4.22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-ppc64le-4.22.9.8.202608191915-0 as a component of Red Hat OpenShift Container Platform 4.22",
          "product_id": "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0"
        },
        "product_reference": "rhcos-ppc64le-4.22.9.8.202608191915-0",
        "relates_to_product_reference": "9Base-RHOSE-4.22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-s390x-4.22.9.8.202608191915-0 as a component of Red Hat OpenShift Container Platform 4.22",
          "product_id": "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0"
        },
        "product_reference": "rhcos-s390x-4.22.9.8.202608191915-0",
        "relates_to_product_reference": "9Base-RHOSE-4.22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-4.22.9.8.202608191915-0 as a component of Red Hat OpenShift Container Platform 4.22",
          "product_id": "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
        },
        "product_reference": "rhcos-x86_64-4.22.9.8.202608191915-0",
        "relates_to_product_reference": "9Base-RHOSE-4.22"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11622",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-07-21T20:12:07.757000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504298"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: bind9: Potential memory usage beyond configured limits",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in BIND\u0027s DNSSEC-validating resolver can lead to a denial of service. An attacker can trigger excessive memory usage by performing a random subdomain attack against a DNSSEC-signed zone, causing the resolver to exceed its `max-cache-size` limits. This is critical for Red Hat deployments where BIND is configured for DNSSEC validation and exposed to untrusted query sources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11622"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504298",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504298"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11622",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11622"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11622",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11622"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:48:35+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:7130a86441e55382a1eecf141edefd4a83c6eb7b27c6cb67883027736b8242b3\n\n      (For s390x architecture)\n      The image digest is\nsha256:d2fc4065149f9310168334a67e530e58d6a80f302877493e9fee91547accb27f\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:a0eb0d2d1b0ae972b00535e3f8b25a825efccca03ac01f1682fbd7f7b790d63d\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:9bf8fa70aacd7119c25e466d563b24b867de1c16648a975978cfb42de7aacc6a\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57362"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: bind9: Potential memory usage beyond configured limits"
    },
    {
      "cve": "CVE-2026-11721",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-07-21T20:22:21.905000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It is possible for an attacker\u0027s zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker\u0027s zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11721"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11721",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11721"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11721",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11721"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:48:35+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:7130a86441e55382a1eecf141edefd4a83c6eb7b27c6cb67883027736b8242b3\n\n      (For s390x architecture)\n      The image digest is\nsha256:d2fc4065149f9310168334a67e530e58d6a80f302877493e9fee91547accb27f\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:a0eb0d2d1b0ae972b00535e3f8b25a825efccca03ac01f1682fbd7f7b790d63d\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:9bf8fa70aacd7119c25e466d563b24b867de1c16648a975978cfb42de7aacc6a\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57362"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards"
    },
    {
      "cve": "CVE-2026-13204",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-07-21T20:41:55.541000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504447"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: bind9: Unexpected exit with NSEC and NSEC3 both present",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13204"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504447",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504447"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13204",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13204"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13204",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13204"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:48:35+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:7130a86441e55382a1eecf141edefd4a83c6eb7b27c6cb67883027736b8242b3\n\n      (For s390x architecture)\n      The image digest is\nsha256:d2fc4065149f9310168334a67e530e58d6a80f302877493e9fee91547accb27f\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:a0eb0d2d1b0ae972b00535e3f8b25a825efccca03ac01f1682fbd7f7b790d63d\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:9bf8fa70aacd7119c25e466d563b24b867de1c16648a975978cfb42de7aacc6a\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57362"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: bind9: Unexpected exit with NSEC and NSEC3 both present"
    },
    {
      "cve": "CVE-2026-13321",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-07-21T19:40:30.464000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504166"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer\u0027s zone.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker controlling any DNSSEC-signed zone can craft NSEC records that span into victim zones, enabling cross-zone cache poisoning with authenticated denial-of-service responses (AD=1).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13321"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504166",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504166"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13321",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13321"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13321",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13321"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:48:35+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:7130a86441e55382a1eecf141edefd4a83c6eb7b27c6cb67883027736b8242b3\n\n      (For s390x architecture)\n      The image digest is\nsha256:d2fc4065149f9310168334a67e530e58d6a80f302877493e9fee91547accb27f\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:a0eb0d2d1b0ae972b00535e3f8b25a825efccca03ac01f1682fbd7f7b790d63d\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:9bf8fa70aacd7119c25e466d563b24b867de1c16648a975978cfb42de7aacc6a\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57362"
        },
        {
          "category": "workaround",
          "details": "Disclaimer: The following mitigation notes are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nISC states no workarounds exist. Until patched, restrict the resolver to authorized client networks and deploy separate resolvers per trust zone. Memory hardening and auth controls don\u0027t apply \u2014 this is a DNS protocol logic error using validly-signed records.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field"
    },
    {
      "cve": "CVE-2026-64531",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-07-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507402"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a local privilege escalation (LPE).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: net: openvswitch: reject oversized nested action attrs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note that Red Hat Enterprise Linux 9.6 and layered products which include the 9.6 kernel do not contain the commits that introduced this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64531"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507402",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507402"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64531",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64531",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64531"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026072732-CVE-2026-64531-e4ce@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026072732-CVE-2026-64531-e4ce@gregkh/T"
        }
      ],
      "release_date": "2026-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:48:35+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:7130a86441e55382a1eecf141edefd4a83c6eb7b27c6cb67883027736b8242b3\n\n      (For s390x architecture)\n      The image digest is\nsha256:d2fc4065149f9310168334a67e530e58d6a80f302877493e9fee91547accb27f\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:a0eb0d2d1b0ae972b00535e3f8b25a825efccca03ac01f1682fbd7f7b790d63d\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:9bf8fa70aacd7119c25e466d563b24b867de1c16648a975978cfb42de7aacc6a\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57362"
        },
        {
          "category": "workaround",
          "details": "Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nIf OVS is not required on a given system, unloading the openvswitch module (`modprobe -r openvswitch`) eliminates the attack surface entirely. For systems that require OVS but cannot patch immediately, the single most effective mitigation is disabling unprivileged user namespaces (`sysctluser.max_user_namespaces=0`), which blocks the primary path an unprivileged attacker uses to obtain CAP_NET_ADMIN and reach the vulnerable netlink interface. Standard kernel hardening (KASLR, SMEP, SMAP, kptr_restrict) is enabled by default on supported RHEL kernels and significantly increases exploitation complexity, but these controls are defense-in-depth and not a substitute for patching or removing the vulnerable module.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608191915-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608191915-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: net: openvswitch: reject oversized nested action attrs"
    }
  ]
}