Daily · Article 01 · 3 min read
- Security
Red Hat releases OpenShift 4.19.55 with a Brotli fix
November 9 JST OpenShift release · follow-up to the previously disclosed Brotli flaw
Summary
Red Hat released OpenShift 4.19.55 on November 9. Here is how to check whether the fix for the exploited Brotli flaw has reached your cluster and apps.
Key facts
If you run the 4.19 line of OpenShift, a platform for operating apps across multiple servers, ask whether 4.19.55 is offered to your cluster and whether the update has completed. Red Hat published the platform update on November 9 at 11:23 JST. It includes fixes for the Brotli decompression flaw CVE-2026-111497 and CVE-2026-98432, a separate flaw in the Linux kernel, the core of the operating system. Red Hat’s Critical rating applies to the update advisory as a whole. Red Hat’s 4.19.55 security advisory
The US cybersecurity agency CISA added the Brotli flaw to its Known Exploited Vulnerabilities catalog on October 27. The new development on November 9 was a fixed OpenShift 4.19 release. The catalog and release cannot establish whether a particular OpenShift cluster was attacked. CISA’s exploited vulnerabilities catalog
1. Where compressed data is opened
Brotli is a way to send data such as a web response in a smaller form. The receiving program decompresses the data to read the original content. Imagine a fictional document-preview service that opens a compressed response from an outside provider. If an attacker controls that data and the service decompresses it using vulnerable Brotli code, the decoder can write beyond the working memory it reserved. Red Hat says that can disclose memory contents, stop the program, or potentially let an attacker run code. Red Hat’s explanation of the Brotli flaw
| Input handled by the fictional service | What to check |
|---|---|
| A normal compressed response is opened for preview | Where the program decompresses data and which code performs that step |
| A crafted Brotli response from outside is decompressed | Whether an attacker can control the input and the program reaches vulnerable decompression code |
- Input handled by the fictional service
A normal compressed response is opened for preview
- What to check
- Where the program decompresses data and which code performs that step
- Input handled by the fictional service
A crafted Brotli response from outside is decompressed
- What to check
- Whether an attacker can control the input and the program reaches vulnerable decompression code
The cat asks Q&A
The researcherCould this happen if the service only stores the Brotli file?
Pocket NotebookThis path requires a program to decompress the crafted data. If a different program opens the file later, check that program’s Brotli version and how the input reaches it.
2. Platform and app copies
A cluster is a group of servers running apps together. OpenShift manages those servers and how the apps run. A container image bundles the files an app needs to start. If the fictional preview app ships its own copy of Brotli, the platform’s copy and the app’s copy come from different bundles. Red Hat’s container image documentation
%% Two update paths in the fictional service
flowchart TD
A["Red Hat platform update"] --> B["Cluster platform"]
B ~~~ C
C["App team’s new image"] --> D["Brotli in the app"]The cat asks Q&A
- The researcher
Should I still ask the app team after updating the platform?
Pocket NotebookYes, if the app bundles Brotli. The app team can identify that copy and check whether the running app moved to a new image if a fix was needed. Check separately which platform and app packages actually include the fix.
3. Release, availability and completion
An update channel is a path that shows the cluster what versions it can move to from its current version. The operator should check which path the cluster is offered for this release. Red Hat’s cluster update guide
| Stage | Owner and status | Evidence to look for |
|---|---|---|
| Brotli component fix | Brotli maintainers · published October 22 JST | Brotli 1.2.1 release |
| 4.19.55 release | Red Hat · confirmed published | Advisory version and both fixes |
| Available to this cluster | Cluster operator · verify per environment | Supported path shown by the console or oc adm upgrade |
| Applied to running systems | Cluster operator · verify per environment | Last completed version, completion time and any remaining updates in the server groups that run apps |
- Stage
Brotli component fix
- Owner and status
- Brotli maintainers · published October 22 JST
- Evidence to look for
- Brotli 1.2.1 release
- Stage
4.19.55 release
- Owner and status
- Red Hat · confirmed published
- Evidence to look for
- Advisory version and both fixes
- Stage
Available to this cluster
- Owner and status
- Cluster operator · verify per environment
- Evidence to look for
- Supported path shown by the console or
oc adm upgrade
- Stage
Applied to running systems
- Owner and status
- Cluster operator · verify per environment
- Evidence to look for
Last completed version, completion time and any remaining updates in the server groups that run apps
The cat asks Q&A
- The researcher
The console shows 4.19.55. What else should I ask?
Pocket NotebookAsk if it appears as the target or the last completed version. If the rollout is complete, ask for its completion time and whether any server group is still updating.
To close
Check the record where the code runs
Find which program decompresses external Brotli data. The update record for its platform or app shows whether the supplier’s fix reached the service you use.
Sources
- Red Hat’s 4.19.55 security advisoryaccess.redhat.com
- CISA’s exploited vulnerabilities catalogcisa.gov
- Red Hat’s explanation of the Brotli flawaccess.redhat.com
- Red Hat’s container image documentationdocs.redhat.com
- Red Hat’s cluster update guidedocs.redhat.com
- Brotli 1.2.1 releasegithub.com