Red Hat Security Advisory

RHSA-2025:23528

multicluster engine for Kubernetes 2.6 security update

Released 2025-12-17 · Red Hat rating Important · View on Red Hat →

Fixed in

multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +6

Fixes 6 records

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2025-07108 CVE-2025-7783 · GHSA-fjxv-7rqg-78g4

Usage of unsafe random function in form-data for choosing boundary

HIGH 76

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).

CVSS 4.0CRITICAL 9.4 Network No auth No interaction EPSS 0.0181 Published 2025-07-18 Partial fix · 2.5.4, 3.0.4 +1 CWE-330

TI-2025-08513 CVE-2025-9288 · GHSA-95m3-7q98-8xr5

Missing type checks leading to hash rewind and passing on crafted data

HIGH 72

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00738 Published 2025-08-20 Partial fix · 2.4.12 CWE-20

TI-2025-08512 CVE-2025-9287 · GHSA-cpq7-6gpm-g9rc

Missing type checks leading to hash rewind and passing on crafted data

HIGH 72

Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0055 Published 2025-08-20 Partial fix · 1.0.5 CWE-20

TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p

Uncontrolled Resource Consumption in promhttp

MEDIUM 48

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05994 Published 2022-02-15 Partial fix · 1.11.1 CWE-400

TI-2025-06557 CVE-2025-7195 · GHSA-856v-8qm2-9wjv

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

LOW 28

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00243 Published 2025-08-07 Partial fix · 0.15.2, v4.17.39-2 +119 CWE-276