RHSA-2026:57845: Important: Red Hat build of MicroShift 4.16.69 security update
Important: Red Hat build of MicroShift 4.16.69 security update
Other sources
Red Hat build of MicroShift is Red Hat's light-weight Kubernetesorchestration solution designed for edge device deployments and is builtfrom the edge capabilities of Red Hat OpenShift Container Platform.MicroShift is an application that is deployed on top of Red Hat EnterpriseLinux devices at the edge, providing an efficient way to operatesingle-node clusters in these low-resource environments.This advisory contains the RPM packages for Red Hat build of MicroShift4.16.69. Read the following advisory for the container images for thisrelease:https://access.redhat.com/errata/RHSA-2026:56854 Security Fix(es): net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame (CVE-2026-33814) net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)All Red Hat build of MicroShift 4.16 users are advised to use these updatedpackages and images when they are available in the RPM repository.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/microshiftto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 - Upgrade
Upgrade
redhat/microshift-greenbootto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 - Upgrade
Upgrade
redhat/microshift-multusto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 - Upgrade
Upgrade
redhat/microshift-multus-release-infoto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 - Upgrade
Upgrade
redhat/microshift-networkingto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 - Upgrade
Upgrade
redhat/microshift-olmto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 - Upgrade
Upgrade
redhat/microshift-olm-release-infoto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 - Upgrade
Upgrade
redhat/microshift-release-infoto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 - Upgrade
Upgrade
redhat/microshift-selinuxto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 - Upgrade
Upgrade
redhat/microshiftto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9.aa - Upgrade
Upgrade
redhat/microshift-multusto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9.aa - Upgrade
Upgrade
redhat/microshift-networkingto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9.aa - Upgrade
Upgrade
redhat/microshift-olmto a version that resolves this vulnerability.Fixed in 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9.aa - Upgrade
Upgrade
MicroShiftto a version that resolves this vulnerability.Fixed in 4.16.69 - Compensating control
Use the updated container images/packages from the referenced errata (RHSA-2026:56854) to address the listed Go vulnerabilities in net/http (CVE-2026-33814), net/mail (CVE-2026-39820, CVE-2026-42499), and golang.org/x/net/idna (CVE-2026-39821).
Event History
Frequently Asked Questions
Which deployments should prioritize this update?
All Red Hat build of MicroShift 4.16 users should prioritize the update. The advisory applies to MicroShift deployments on Red Hat Enterprise Linux edge devices, including single-node, low-resource clusters.
What kinds of attacks are addressed by this update?
The update fixes denial-of-service issues involving malformed HTTP/2 SETTINGS_MAX_FRAME_SIZE frames and crafted or pathological email inputs. It also fixes a privilege-escalation issue related to incorrect Punycode label processing in golang.org/x/net/idna.
Are container images covered by this advisory?
This advisory contains RPM packages for Red Hat build of MicroShift 4.16.69. Container images for the release are covered by the separate RHSA-2026:56854 advisory.