Loading story…
Red Hat released OpenShift Container Platform updates to remediate CVE-2024-28180, a denial-of-service flaw in the Go jose-go implementation. An attacker who can submit a crafted compressed JSON Web Encryption (JWE) object to code using Decrypt or DecryptMulti can trigger disproportionate memory and CPU consumption during decompression. Upstream fixed the issue in jose-go versions 4.0.1, 3.0.3, and 2.6.3 by limiting decompression to 250 kB or ten times the compressed input size, whichever is greater.
The vulnerability was included in OpenShift 4.12, 4.13, and 4.15 security releases, including 4.12.54, 4.12.57, 4.12.58, 4.13.38, and 4.15.6 through 4.15.15. Affected deployments span RHEL 8 and RHEL 9 on x86_64, IBM Power, IBM Z/LinuxONE, and ARM64 platforms. Red Hat advises OpenShift administrators to upgrade affected packages and container images through their applicable release channels; the advisories do not report exploitation in the wild.
See affected versions and whether adversaries are exploiting it.
36 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2024:8991 for OpenShift Container Platform 4.15.38, supplying updated packages and container images for supported RHEL 8 and 9 architectures. The update remediated issues including OAuth2 state-parameter entropy weakness CVE-2024-6508, DOMPurify mutation XSS CVE-2024-47875, and denial-of-service vulnerabilities in OpenTelemetry and QEMU NBD.
Red Hat issued RHSA-2024:7179, a Moderate security and bug-fix advisory making OpenShift Container Platform 4.15.35 packages and container images available. The update remediates the jose-go compressed-data handling flaw CVE-2024-28180 and includes additional fixes for metrics, cluster installation, identity-provider connectivity, networking, and hosted clusters.
Red Hat issued RHSA-2024:4455, a Moderate-severity advisory providing OpenShift Virtualization 4.16.0 images for Red Hat Container Native Virtualization 4.16 on RHEL 9. The update remediated CVE-2024-28180 in jose-go, CVE-2024-24786 in golang-protobuf, and CVE-2023-45857 in axios, alongside functional and stability fixes.
Red Hat issued RHSA-2024:4006, an Important security advisory, releasing OpenShift Container Platform 4.12.60 container images. The update remediated CVE-2024-28180 in jose-go, CVE-2023-45288 in Go HTTP/2, and CVE-2022-21708 in graphql-go.
Red Hat issued RHSA-2024:4010, an Important-rated advisory providing OpenShift Container Platform 4.14.31 container images and packages. The update remediated CVE-2024-28180 in jose-go along with denial-of-service flaws in Go HTTP/2 and go-git and the SSH prefix-truncation issue CVE-2023-48795.
Red Hat issued RHSA-2024:4041, an Important security advisory providing OpenShift Container Platform 4.15.19 packages and container images. The update remediated CVE-2024-28180 in jose-go, the Go HTTP/2 CONTINUATION-frame denial-of-service flaw CVE-2023-45288, and other listed issues.
Red Hat issued Moderate-severity RHSA-2024:3968 for the RHEL 8 container-tools module, updating Podman, Buildah, Skopeo, runc, and related packages. The update remediated jose-go resource-exhaustion flaws CVE-2024-28176 and CVE-2024-28180, including for RHEL 8.10 Extended Life Cycle deployments.
Red Hat issued RHSA-2024:3827, a Moderate security advisory for Buildah on RHEL 9. Buildah 1.33.7-2.el9_4 remediates CVE-2024-28180, CVE-2024-28176, and the Go net/http resource-exhaustion vulnerability CVE-2023-45290.
Red Hat issued RHSA-2024:3826, a Moderate security and bug-fix update for Podman on RHEL 9. Podman version 4.9.4-4.el9_4 remediates CVE-2024-28180 in jose-go, CVE-2024-28176 in jose, and CVE-2023-45290 in Go net/http.
Red Hat issued Important-rated RHSA-2024:3523 for OpenShift Container Platform 4.14.28, providing updated container images for RHEL 8 and RHEL 9. The update remediated CVE-2024-28180 in jose-go and the Go HTTP/2 CONTINUATION-frame denial-of-service flaw CVE-2023-45288.
Red Hat issued Moderate-severity advisory RHSA-2024:3351 for OpenShift Container Platform 4.12.58 on RHEL 8, providing updated RPM packages that remediate CVE-2024-28180 in jose-go. The update covers supported x86_64, ppc64le, s390x, and aarch64 deployments; corresponding container images were issued under RHSA-2024:3349.
RHSA-2024:3349 released OpenShift Container Platform 4.12.58 container images that addressed CVE-2024-28180, along with additional bug fixes and enhancements.
RHSA-2024:3327 released OpenShift Container Platform 4.15.15 images and packages fixing CVE-2024-28180, the Go HTTP/2 denial-of-service issue CVE-2023-45288, and Gunicorn request smuggling CVE-2024-1135.
Red Hat issued Important-rated RHSA-2024:2877, providing OpenShift Container Platform 4.13.42 RPM packages for RHEL 8 and RHEL 9. The update remediated jose-go compressed-data handling flaw CVE-2024-28180 and Buildah container-escape vulnerability CVE-2024-1753; corresponding container images were provided under RHSA-2024:2875.
Red Hat issued Moderate-severity advisory RHSA-2024:2869 for OpenShift Container Platform 4.14.26, providing updated packages and container images for supported RHEL 8 and RHEL 9 architectures. The update remediated jose-go's compressed-data handling vulnerability, CVE-2024-28180.
Red Hat issued RHSA-2024:3254 for the container-tools:rhel8 module in RHEL 8. The Important update remediated CVE-2024-28180 in jose-go, the Buildah container-escape flaw CVE-2024-1753, and issues in Go net/http, regexp, and golang-protobuf; it included Buildah 1.33.7, Podman 4.9.4, runc 1.1.12, and Skopeo 1.14.3.
RHSA-2024:2865 released OpenShift Container Platform 4.15.14 images and packages addressing CVE-2024-28180, Go HTTP/2 and OpenTelemetry denial-of-service flaws, and Helm path-traversal and panic issues.
RHSA-2024:2784 released OpenShift Container Platform 4.12.57 RPM packages fixing CVE-2024-28180, a Buildah container-escape flaw, and a CRI-O command-injection flaw.
RHSA-2024:2773 released OpenShift Container Platform 4.15.13 images and packages that remediated CVE-2024-28180 and several other denial-of-service vulnerabilities in Go, goproxy, OpenTelemetry, and golang-protobuf components.
Red Hat issued Important-rated RHSA-2024:2669 for OpenShift Container Platform 4.15.12, remediating CVE-2024-28180 in jose-go, the Buildah build-time container escape CVE-2024-1753, and CRI-O pod-annotation command injection CVE-2024-3154. Updated packages and container images were provided for supported RHEL 8 and RHEL 9 architectures.
Red Hat issued RHSA-2024:2672 for OpenShift Container Platform 4.14.24, providing updated packages and images that remediate CVE-2024-28180 in jose-go. The Important-rated update also fixed CVE-2023-45288 in Go HTTP/2, the Buildah container-escape flaw CVE-2024-1753, and CRI-O command injection CVE-2024-3154.
Red Hat issued Moderate-severity advisory RHSA-2024:2054 for OpenShift Container Platform 4.14.23, providing RPM packages that remediate CVE-2024-28180 in jose-go. Corresponding container images were provided through RHBA-2024:2051 for supported RHEL 8 and RHEL 9 architectures.
Red Hat issued RHSA-2024:2049 for OpenShift Container Platform 4.13.41, providing updated RPM packages that remediate CVE-2024-28180 in jose-go, the Go HTTP/2 denial-of-service flaw CVE-2023-45288, and the Buildah container-escape vulnerability CVE-2024-1753.
Red Hat issued RHSA-2024:2639, a Moderate-security advisory providing Migration Toolkit for Containers 1.7.15 for Red Hat Migration Toolkit 1 on RHEL 8 x86_64. The update remediated CVE-2024-28180 in jose-go and the golang-protobuf protojson unmarshalling infinite-loop flaw CVE-2024-24786.
Red Hat issued Moderate-severity advisory RHSA-2024:1859 for OpenShift API for Data Protection 1.3.1 on RHEL 9. The update remediated CVE-2024-28180 in jose-go, CVE-2024-24786 in golang-protobuf, and four other vulnerabilities affecting OpenTelemetry, Go, and SSH, while adding backup, restore, and configuration fixes.
Red Hat issued Moderate-severity RHSA-2024:1812 for Custom Metrics Autoscaler Operator for OpenShift, updating x86_64 deployments to version 2.12.1-376. The KEDA-based update remediated CVE-2024-28180 in jose-go, Go net/http denial-of-service CVE-2023-39326, and OpenTelemetry otelgrpc denial-of-service CVE-2023-47108, and fixed a Prometheus-scaler memory leak and ServiceMonitor endpoint issue.
RHSA-2024:1574 released OpenShift Container Platform 4.12.54 packages, addressing CVE-2024-28180 as well as vulnerabilities in golang-fips/openssl and golang-protobuf.
Red Hat issued RHBA-2024:1661, updating the web-terminal/tooling container image for Red Hat Web Terminal 1.7 on RHEL 8. The image includes backported fixes for CVE-2024-28180, CVE-2024-24786, and CVE-2024-1394; users were advised to upgrade and rebuild dependent images.
RHSA-2024:1563 provided OpenShift Container Platform 4.15.6 packages that fixed CVE-2024-28180 alongside CVE-2024-1394 in golang-fips/openssl and CVE-2024-24786 in golang-protobuf.
RHSA-2024:1456 released updated RPM packages for OpenShift Container Platform 4.13.38, remediating CVE-2024-28180 and the golang-protobuf infinite-loop flaw CVE-2024-24786.
Red Hat created Fedora and EPEL tracking bugs for CVE-2024-28180, covering numerous dependent packages including container tooling, orchestration components, and jose-go packages.
Red Hat remediated CVE-2024-3154, a CRI-O pod-annotation flaw allowing arbitrary systemd-property injection and potential host actions, for OpenShift Container Platform 4.13 through RHSA-2024:3496.
Red Hat documented CVE-2024-1753, in which unvalidated bind-mount sources during Buildah RUN steps can let a malicious Containerfile mount and obtain read-write access to the host root filesystem. Red Hat issued fixes across affected RHEL 8 and 9 variants, including EUS releases, and OpenShift Container Platform versions 4.12 through 4.15.
Red Hat released OpenShift Container Platform 4.16.13 package and container-image updates rated Important. The update remediated CVE-2024-28180 along with CVE-2024-7387, a BuildContainer path-traversal command-injection flaw, and CVE-2024-45496, in which elevated build pods could lead to node compromise.
Red Hat issued RHEA-2024:4022 for the OpenShift Pipelines 1.15 RHEL 8 openshift-pipelines-client component, remediating CVE-2024-28180 in go-jose.
Go JOSE fixed CVE-2024-28180, in which compressed JWE input processed by Decrypt or DecryptMulti could consume excessive memory and CPU. Versions 4.0.1, 3.0.3, and 2.6.3 impose decompression limits of 250 kB or ten times the compressed input size, whichever is greater.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
39 references tracked. Mallory keeps watching after this page renders.
docs.openshift.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcedocs.openshift.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated OpenShift Container Platform updates for versions 4.15, 4.16, 4.17, and 4.18, including 4.15.50, 4.16.33, 4.17.25, 4.18.8, and 4.18.9. The releases remediate **CVE-2025-30204**, a high-severity denial-of-service flaw in `golang-jwt/jwt` where JWT header parsing can cause excessive memory allocation from attacker-controlled tokens containing numerous period characters. Fixed upstream versions are 4.5.2 and 5.2.2. The updates also address **CVE-2024-11218**, a Podman/Buildah race condition that can enable container breakout, plus flaws in GRUB2, libxml2, Jinja2, BIND, and go-jose. Several releases fix **CVE-2025-29781**, in which the Bare Metal Operator's `BMCEventSubscription` custom resource could expose secrets across namespaces. Red Hat advises affected organizations to upgrade clusters through their applicable OpenShift release channels using the OpenShift CLI or web console across supported RHEL 8 and RHEL 9 platforms.
Aug 27, 2026
Red Hat released security updates across **OpenShift Container Platform (OCP) 4.12 through 4.16** and OpenShift Serverless, remediating vulnerabilities in bundled Go, Linux kernel, glibc, OpenTelemetry, BIND, Ironic, Gunicorn, Werkzeug, and related components. The issues include HTTP/2 and multipart-form memory-exhaustion denial of service—such as `CVE-2023-45288` and `CVE-2023-45290`—sensitive URL data written to logs (`CVE-2024-6104`), cluster-monitoring credential leakage, unauthenticated local access and data exposure in OpenStack Ironic, and an SSH prefix-truncation attack. OpenShift 4.16.0 addressed 16 vulnerabilities, while the 4.14.39 update also fixed a glibc `iconv` out-of-bounds write that may allow remote code execution. Affected organizations should update OCP container images and packages through their supported release channels using the OpenShift CLI or web console, prioritizing deployed 4.12, 4.14, 4.15, and 4.16 clusters. The advisories cover RHEL 8 and RHEL 9 deployments across `x86_64`, `s390x`, `ppc64le`, and `aarch64` where applicable; OpenShift Serverless 1.33.0 also updates Serverless Operator components for OCP 4.12–4.16. Red Hat separately updated the RHEL 9 Go toolchain to version `golang-1.21.9-2.el9_4`, addressing HTTP processing, certificate-verification, redirect-forwarding, template escaping, and cryptographic flaws that affect Go-based workloads and platform components.
Aug 27, 2026
Red Hat released security updates for **OpenShift Container Platform** 4.12, 4.17, and 4.18, delivering updated container images and packages through the supported release channels. The advisories address `CVE-2025-32462`, a sudo flaw that permits misuse of the `-h`/`--host` option outside privilege-listing operations and can enable local privilege escalation under applicable sudoers rules, affecting Red Hat Enterprise Linux and multiple OpenShift releases. The updates also remediate `CVE-2025-22868` in `golang.org/x/oauth2/jws`, where JWS token parsing can trigger unexpected memory consumption. OpenShift 4.17.35 additionally fixes node pull-credential overwrite, HTTP request smuggling in Go `net/http`, and unsafe library-path searching by static setuid glibc binaries; OpenShift 4.18.16 also includes a fix for `CVE-2016-9840` in zlib. Red Hat advises affected organizations to upgrade their clusters using the OpenShift CLI or web console.
Aug 27, 2026