VDB
RHSA-2026:70617
RHSA-2026:70617
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:e5fc274ce27cfe2c023b6dc9c0d4ab9e20fdbc4a8ad7291f9074d00a91b572fc_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-cloud-controller-manager-rhel9@sha256:9666542774a0690b3ef8d7e1b16e24e9ee1745e3300a31f87da456ee230b8a7d_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator@sha256:e11e2a579ba493f7418c9b0b7dd3c492a8bd72b614a8d30f2824e576f6aa3dcb_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-haproxy-router-rhel9@sha256:8cbe0d44a3b389260d2bf62180ff05ba5ba8122ffef90e7d48a1efaa28b23125_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:7c80faca2c7393352342483684c4f7bbe42ecbc64fc62d76f0bfe9b02423a4ac_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-cni-microshift-rhel9@sha256:e7b90855be0c33b872c641614fec87df90523447b4aac3d14c0124d753a64546_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-rhel9@sha256:71a1177750458ea46b285eabd871b7504fcf94e50f02af2a2c8522d8c8b91ded_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:feb6b52fac948d1a49cd3e403214699b2dfd2e28f9489543d83856a5194c6805_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-rhel9-operator@sha256:b4742ce5caa7355313891fc08a0dd5d353025569d6eec56a8cf251d307804a8e_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9@sha256:098a8964e16a9d6cd7220ba7d1627e6d92ef02ce23d53e46af49cd8094705bf5_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-console-rhel9-operator@sha256:68e2cec4865b6963a1661f8312cba03e52e78e2ceca808a5b8bf4b51229576a3_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9@sha256:0dadfa1468f441932601f1688c3679e82e0afc40463df043fd3d47bab36f507f_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-etcd-rhel9@sha256:a50c206f3ecb9e4680c471c33e3802f93333e0961ea6b1b08d93504a44befd18_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b8324785ea9ad8d6dbc5d534df120fb4afd2a7842caa6b0fbbeaa88753bb2a36_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-node-driver-registrar-rhel9@sha256:dd4f7b74f4ed8ebf4c8b28dde4d743e3a7472ad0f8e6dfcab64e3af11fa78891_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-cluster-api-rhel9-operator@sha256:a5a451cc39c8c00a0ea877980b1969ab480c61f20ab8b5ecd13ad6a183e15e9c_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:3de6b18d9f650a0e6da91decab36ebf19676c5e57cff82d765df6b43a7e2ae5b_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-os-images-rhel9@sha256:555b17ef5e8930d922e7e042569d6aefc227713e12869c53cec8f2ed561db062_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-monitoring-rhel9-operator@sha256:07ad178c6aa882d64a9304c3387f0b386e869d0e9ad1026af84bf96eaac6c7ef_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:db4037a2e4a25b42e6c4f2e9b8f1e09a987fa4a5584067e0c886d2a13c0a833e_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
…and 630 more
Timeline
- Oct 1, 2026 CVE Published
- Oct 4, 2026 CVE Updated
- Oct 4, 2026 Distribution Patch
- Oct 4, 2026 Distribution Patch
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:70617 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-33818 advisory
- https://access.redhat.com/security/cve/CVE-2026-44990 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-48801 advisory
- https://access.redhat.com/security/cve/CVE-2026-56858 advisory
- https://access.redhat.com/security/cve/CVE-2026-56859 advisory
- https://access.redhat.com/security/cve/CVE-2026-56860 advisory
- https://access.redhat.com/security/cve/CVE-2026-56862 advisory
- https://access.redhat.com/security/cve/CVE-2026-75885 advisory
- https://access.redhat.com/security/cve/CVE-2026-75886 advisory
- https://access.redhat.com/security/cve/CVE-2026-75887 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70617.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
- https://go.dev/cl/761640 advisory
…and 59 more