Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.14 security, enhancement & bug fix update

🗓️ 16 Jun 2026 16:41:50Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 15 Views

Red Hat OpenShift Data Foundation 4.20.14 security, enhancement and bug fix update.

Reporter	Title	Published	Views	Family All 2013
vulnersOsv	org.webjars.npm:compression (>=1.5.2 <=1.7.4), org.webjars.npm:express-session (>=1.15.6 <=1.17.1) +1 more potentially affected by CVE-2025-7339 via org.webjars.npm:on-headers (=1.0.2)	17 Jul 202516:41	–	vulnersosv
vulnersOsv	0utmailauth (=1.0.0), 0xsodium (>=0.2.0 <=0.14.0) +13812 more potentially affected by CVE-2026-22036 via undici (>=0.3.3 <=6.22.0)	14 Jan 202621:06	–	vulnersosv
vulnersOsv	org.webjars.npm:actions__core (>=1.10.0 <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1 <=2.2.3) +14 more potentially affected by CVE-2026-22036 via org.webjars.npm:undici (>=4.12.2 <=5.29.0)	14 Jan 202619:51	–	vulnersosv
vulnersOsv	0utmailauth (=1.0.0), @1023-ventures/ursa-core (>=0.5.2 <=0.5.3) +1939 more potentially affected by CVE-2026-22036 via undici (>=6.0.0 <=6.22.0)	14 Jan 202619:51	–	vulnersosv
vulnersOsv	10by10-react-app (=1.2.1), 192.168.0.172 (=4.6.1) +13968 more potentially affected by CVE-2025-7339 via on-headers (>=0.0.0 <=1.0.2)	17 Jul 202521:17	–	vulnersosv
vulnersOsv	@01.software/sdk (>=0.0.1-251008.90016 <=0.1.0-dev.260109.7cf07c9), @adenta/cms (>=0.0.6 <=1.1.1-0) +257 more potentially affected by CVE-2026-22036 via undici (>=7.0.0 <=7.18.0)	14 Jan 202621:06	–	vulnersosv
vulnersOsv	@01.software/sdk (>=0.0.1-251008.90016 <=0.1.0-dev.260109.7cf07c9), @adenta/cms (>=0.0.6 <=1.1.1-0) +258 more potentially affected by CVE-2026-22036 via undici (>=7.0.0-alpha.3 <=7.18.0)	14 Jan 202619:51	–	vulnersosv
Vulnrichment	CVE-2025-7339 on-headers vulnerable to http response header manipulation	17 Jul 202515:47	–	vulnrichment
Vulnrichment	CVE-2026-22036 Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion	14 Jan 202619:07	–	vulnrichment
Vulnrichment	CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path	20 Mar 202622:23	–	vulnrichment

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-33186
access	www.access.redhat.com/security/updates/classification/
docs	www.docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/

04 Aug 2026 02:06Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.17.5 - 9.1

EPSS0.01557

SSVC

OpenShift Data Foundation Security Advisory Bug Fixes Enhancements