{
  "document" : {
    "aggregate_severity" : {
      "namespace" : "https://access.redhat.com/security/updates/classification/",
      "text" : "Important"
    },
    "category" : "csaf_security_advisory",
    "csaf_version" : "2.0",
    "distribution" : {
      "text" : "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "en",
    "notes" : [ {
      "category" : "summary",
      "text" : "Red Hat OpenShift Virtualization release v4.21 is now available with updates to packages and images that fix several bugs and add enhancements.",
      "title" : "Topic"
    }, {
      "category" : "general",
      "text" : "OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization v4.21 images.",
      "title" : "Details"
    }, {
      "category" : "legal_disclaimer",
      "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
      "title" : "Terms of Use"
    } ],
    "publisher" : {
      "category" : "vendor",
      "contact_details" : "https://access.redhat.com/security/team/contact/",
      "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name" : "Red Hat Product Security",
      "namespace" : "https://www.redhat.com"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "https://access.redhat.com/errata/RHSA-2026:53734",
      "url" : "https://access.redhat.com/errata/RHSA-2026:53734"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/cve/CVE-2026-40898",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-40898"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/updates/classification/",
      "url" : "https://access.redhat.com/security/updates/classification/"
    }, {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53734.json"
    } ],
    "title" : "Red Hat Security Advisory: OpenShift Virtualization v4.21 Images",
    "tracking" : {
      "current_release_date" : "2026-08-22T18:39:47+00:00",
      "generator" : {
        "date" : "2026-08-22T18:39:47+00:00",
        "engine" : {
          "name" : "Red Hat SDEngine",
          "version" : "5.3.16"
        }
      },
      "id" : "RHSA-2026:53734",
      "initial_release_date" : "2026-08-11T17:14:33+00:00",
      "revision_history" : [ {
        "date" : "2026-08-11T17:14:33+00:00",
        "number" : "1",
        "summary" : "Initial version"
      }, {
        "date" : "2026-08-22T06:15:42+00:00",
        "number" : "2",
        "summary" : "Last updated version"
      }, {
        "date" : "2026-08-22T18:39:47+00:00",
        "number" : "3",
        "summary" : "Last generated version"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Red Hat Container Native Virtualization 4.21",
          "product" : {
            "name" : "Red Hat Container Native Virtualization 4.21",
            "product_id" : "Red Hat Container Native Virtualization 4.21",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:redhat:container_native_virtualization:4.21::el9"
            }
          }
        } ],
        "category" : "product_family",
        "name" : "Red Hat Container Native Virtualization"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64",
          "product" : {
            "name" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64",
            "product_id" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/kubevirt-apiserver-proxy-rhel9@sha256%3Af0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe?arch=amd64&repository_url=registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9&tag=1786125762"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "amd64"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64",
          "product" : {
            "name" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64",
            "product_id" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/kubevirt-apiserver-proxy-rhel9@sha256%3A87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca?arch=arm64&repository_url=registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9&tag=1786125762"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "arm64"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x",
          "product" : {
            "name" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x",
            "product_id" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x",
            "product_identification_helper" : {
              "purl" : "pkg:oci/kubevirt-apiserver-proxy-rhel9@sha256%3A3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949?arch=s390x&repository_url=registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9&tag=1786125762"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "s390x"
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    } ],
    "relationships" : [ {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x as a component of Red Hat Container Native Virtualization 4.21",
        "product_id" : "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x"
      },
      "product_reference" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x",
      "relates_to_product_reference" : "Red Hat Container Native Virtualization 4.21"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64 as a component of Red Hat Container Native Virtualization 4.21",
        "product_id" : "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64"
      },
      "product_reference" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64",
      "relates_to_product_reference" : "Red Hat Container Native Virtualization 4.21"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64 as a component of Red Hat Container Native Virtualization 4.21",
        "product_id" : "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64"
      },
      "product_reference" : "registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64",
      "relates_to_product_reference" : "Red Hat Container Native Virtualization 4.21"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-40898",
    "cwe" : {
      "id" : "CWE-770",
      "name" : "Allocation of Resources Without Limits or Throttling"
    },
    "discovery_date" : "2026-06-04T19:00:56.584166+00:00",
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2484875"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-of-service (DoS) condition where the affected server or client may crash or run out of resources.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "This is an Important denial-of-service flaw in `quic-go` that allows a remote attacker to exhaust system memory by sending specially crafted HTTP/3 trailer fields. This can lead to crashes or resource unavailability in affected Red Hat products utilizing `quic-go` for HTTP/3 communication, impacting both client and server implementations.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x", "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64", "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-40898"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2484875",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2484875"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-40898",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-40898"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40898",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40898"
    }, {
      "category" : "external",
      "summary" : "https://github.com/quic-go/quic-go/releases/tag/v0.59.1",
      "url" : "https://github.com/quic-go/quic-go/releases/tag/v0.59.1"
    }, {
      "category" : "external",
      "summary" : "https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9",
      "url" : "https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9"
    } ],
    "release_date" : "2026-06-04T17:43:36.803000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-08-11T17:14:33+00:00",
      "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
      "product_ids" : [ "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x", "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64", "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:53734"
    }, {
      "category" : "workaround",
      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
      "product_ids" : [ "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x", "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64", "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64" ]
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.5,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "NONE",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "version" : "3.1"
      },
      "products" : [ "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:3d5e780f39f8c43db9a3a874abe982f658597018e534692199d1d3efa1fa9949_s390x", "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:87a974f9fb639ab3a3c20dc40e1ee88dc4f6cd5ee3f55b4397a99e2c1defd5ca_arm64", "Red Hat Container Native Virtualization 4.21:registry.redhat.io/container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:f0f9c298f70edf207f4efa03b5fb51c34886d68deb2dda4ab7dc2ad3e5e0fefe_amd64" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers"
  } ]
}