VDB

RHSA-2026:60454

RHSA-2026:60454 PUBLISHED CVSS 8.5 HIGH

Record from redhat · Published September 2, 2026

A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.

Risk scores

CVSS 3.1
8.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

VendorProductVersions
Red Hatregistry.redhat.io/openshift4/ose-ironic-static-ip-manager-rhel9@sha256:f51627ad1c82692cacbfffd53b735f70265b0320e99a72a44ebd61172ffd460a_arm64 as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-monitoring-plugin-rhel9@sha256:514a05023b52a3fe82bef25735089f9e4d5c71afb39243d6950a14efb2d9599c_ppc64le as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-openstack-cloud-controller-manager-rhel9@sha256:c875cbc599e0b3409ea7d9be2d5ee95e797066063affeb915953e672a207d628_amd64 as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel9@sha256:cc1bf2be4c51f64f6a4d51b32fe80a9a88ed11218f2ce01cab6e9e46af117a39_amd64 as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-docker-registry-rhel9@sha256:8ad1322f421de768fe1b423ad61a05540fde20b4f4ff96f4712aa9e05ff828b4_s390x as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-multus-cni-microshift-rhel9@sha256:824c2457204a038bc37470f7f4846c3ff906c74e0169883f8481d6244e9112d7_arm64 as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:97d1f45233730f66e0c627c81b729aba7aea1db10fc8408cca84eabb7fe80bf7_s390x as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9-operator@sha256:cda9462079c40b6dfc36d0987d724a96c113827a76275249a17ffde31c6771cd_s390x as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-baremetal-cluster-api-controllers-rhel9@sha256:61803760672a76c19140b311c2fff487721ea0bfe85fd213e2940116819238de_ppc64le as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:8093caec89c112c6dc71b4c0f1424bb3cfd2cb2275c8ca21d3f46534dc3dac5e_s390x as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-kube-storage-version-migrator-rhel9@sha256:9ed6afae6fa589f8a6bcc588be5cdd880de94e1b913644f3adcd449642f16089_amd64 as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:2b0bb51c3cfa64e98a4ac8df637c6c55d8971887ce15c0ccbe35816c5bd5b144_s390x as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-cluster-csi-snapshot-controller-rhel9-operator@sha256:4998b7e92c84d89b59f5e3f3c6a90007c977864a34dc74ff2948ad86b0fad60c_s390x as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-csi-livenessprobe-rhel9@sha256:ca6943cb878201a0be717b79b856f3535c033da3ee9239997d2f5daa900b830f_arm64 as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9@sha256:16679510bd2f32130344fb604b327daf78ad14250003eed9b8c446b527d1a650_s390x as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ovirt-csi-driver-rhel9@sha256:9b1da8a17b0226089b68bafee8680bb08eb6efee35ef489cbf62e932bfbce5e7_ppc64le as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-deployer-rhel9@sha256:93679126bba693b961cb4b1e4c1c1b3df72e6b8f40985f8aa99fe4a1bc57e39a_s390x as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-operator-lifecycle-manager-rhel9@sha256:4eabf5a72bd03980c2a3dc91e0c9cd923e867483d8edd859ddf1210737eed759_amd64 as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:c51ecce77838bec872a7791336b13b3560566536b13bbe5e5e2eb70ac7a8a016_s390x as a component of Red Hat OpenShift Container Platform 4.19*
Red Hatregistry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9-operator@sha256:389c8e647e0d821d362ba86512dcd946659f260949d62c7d4cd5378262ee9bb4_ppc64le as a component of Red Hat OpenShift Container Platform 4.19*

…and 638 more

Timeline

  • Sep 2, 2026 CVE Published
  • Sep 27, 2026 CVE Updated
  • Sep 27, 2026 Distribution Patch (2 in total, the first dated here)
  • Sep 27, 2026 Security Advisory (5 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln RHSA-2026:60454
vulnetix vdb fixes RHSA-2026:60454

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A60454/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 16 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›