VDB
RHSA-2026:57408
RHSA-2026:57408
PUBLISHED
CVSS 8.699999809265137 HIGH
A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.
Risk Scores
CVSS 3.1
8.699999809265137
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-kubevirt-cloud-controller-manager-rhel9@sha256:ea3dd501c024045a8918b32717ec5be4c12fcf3b12fc2a819b4ab6fc087e3464_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-config-api-rhel9@sha256:0e48ea5e3befd9f0658dc09128ee17ea11e346b276aed7448746e57b363f075c_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:2ee63bfc1e86048645c0591fa4d82c4ce844083e6bc95e48a4e3324a20aaaef6_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel9@sha256:650574e3366854c4bc1c927b783f67830d01e01c444aa297846a7821fa509b07_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-docker-builder-rhel9@sha256:3a845f459e7ecd0d3703a448382683ea02273e9491fc4c45fc21644b7160be0b_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:ef891ee6bbe0dc8365d231fa682689e397b551047d96505e22a0a69ea3eaa9d8_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-installer-artifacts-rhel9@sha256:e378a8915c290cfc2c9797a8d704a9879437ba715bcfed8e9c6be982ad3a0eeb_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cli-artifacts-rhel9@sha256:038b79ede165e7f5003ab5d992ed5c11c967edf310df4984bbf7f1c44c7ff32a_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9@sha256:79649c10ddcadb482a5912c5bac16afaa47b68c3fa566ea374050ab9d0016b22_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:f3d88b2b5ce62e798198bd21e1b29294c9bcd84f9219de6966cb9da9ffca60f0_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel9@sha256:163a9facf5987f05ba16ae9cc9523b3b69da18eb4fb93d8413d6f143e1eb6603_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-provider-aws-rhel9@sha256:37af8feabea58fd46bb94988539636d9c1154c0d258702b1e9ddda34498ae7bd_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-operator-admission-webhook-rhel9@sha256:151b9efa1d3b39ff36cd0fd4d7a01d9294567622c854aacd51e9e0ac15222df2_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-proxy-rhel9@sha256:330f1f17d6b437552257ddd388fec579645d723c50754c076a2c1bde368d147b_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/network-tools-rhel9@sha256:f321828c59266e98b206326a5efccd3080a286bf6d1f7839ef5d9fbb3afe883a_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-olm-rhel9-operator@sha256:422d9d23eab511a4e657dc694b7b67cbb1a23ffd08b8860ccd20d9f2cbac7708_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-rhel9-operator@sha256:5c6013cd3d92314a7bdd6a116e20171c38bf77be296fd1dcf8d70195f74e2500_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:aaa80c1777568bc970461e1b8acd5c4edfe01a68434a57bd67702f580999eac6_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-service-ca-rhel9-operator@sha256:c49818d2aa6b2c5df2d8e3506b86a0c9da52dffc4603974174cec8a743cce16b_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:f0da8e4347e6e9e0aa552324044189ab095d696cd6b50b009797d8838c86f58d_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
…and 638 more
Timeline
- Aug 26, 2026 CVE Published
- Sep 24, 2026 CVE Updated
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:57408 advisory
- https://access.redhat.com/security/cve/CVE-2026-14362 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27140 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-34986 advisory
- https://access.redhat.com/security/cve/CVE-2026-42965 advisory
- https://access.redhat.com/security/cve/CVE-2026-44918 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-9595 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57408.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488934 issue
- https://www.cve.org/CVERecord?id=CVE-2026-9595 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9595 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/facebook/create-react-app/pull/7444 advisory
- https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb advisory
- https://github.com/webpack/webpack-dev-server/pull/4316 advisory
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79 advisory
…and 46 more