Read the docs
TI-2025-16740 Aliases CVE-2025-22868GHSA-6v2p-p543-phr9

Unexpected memory consumption during token parsing in golang.org/x/oauth2

Priority MEDIUM 40CWE-1286Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 57 fixed, 23 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0087 59th percentileScored 2026-11-07
Fix Partial golang.org/x/oauth2/jws (golang.org/x/oauth2): 0.27.0golang.org/x/oauth2 (Go): 0.27.0Red Hat: 82 advisoriesRed Hat: 57 fixed, 23 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
golang.org/x/oauth2golang.org/x/oauth2/jwsbefore 0.27.00.27.0Patch availableCNA
—golang.org/x/oauth2 (Go)before 0.27.00.27.0Patch availableGHSA-6v2p-p543-phr9
  • golang.org/x/oauth2/jws Vendorgolang.org/x/oauth2 Affected before 0.27.0 Fixed in 0.27.0 Patch available CNA
  • golang.org/x/oauth2 (Go) Vendor— Affected before 0.27.0 Fixed in 0.27.0 Patch available GHSA-6v2p-p543-phr9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:go:jws:*:*:*:*:*:go:*:*before 0.27.0VulnerableGo
  • cpe:2.3:a:go:jws:*:*:*:*:*:go:*:* Versions before 0.27.0 Vulnerable ·Go

Remediation

  • Fix · CNA golang.org/x/oauth2/jws (golang.org/x/oauth2) Fixed in 0.27.0
  • Fix · GHSA-6v2p-p543-phr9 golang.org/x/oauth2 (Go) Fixed in 0.27.0 Advisory →

Red Hat 82 advisories

  • RHSA-2026:34342 Released 2026-07-01 · Red Hat rating Critical
    Cluster Observability Operator 1.5.0
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
  • RHSA-2026:3718 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.4
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel8
  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
Show 79 more Red Hat advisories
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:3406 Released 2026-02-26 · Red Hat rating Important
    New container image: rhceph-9.0
    • Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
  • RHSA-2026:2172 Released 2026-02-05 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.15 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:2164 Released 2026-02-05 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2025:23535 Released 2025-12-17 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.12
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/logging-loki-rhel9
  • RHSA-2025:23534 Released 2025-12-17 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.2.7
    • Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/logging-loki-rhel9
  • RHSA-2025:23449 Released 2025-12-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23209 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (TPU)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-tpu-rhel9
  • RHSA-2025:23205 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23204 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:23202 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2025:23080 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2025:23079 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23078 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:23057 Released 2025-12-10 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.3.2
    • Logging for Red Hat OpenShift 6.3 registry.redhat.io/openshift-logging/logging-loki-rhel9
  • RHSA-2025:17671 Released 2025-10-16 · Red Hat rating Important
    OpenShift Container Platform 4.12.81 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-coredns, registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel8, registry.redhat.io/openshift4/ose-nutanix-machine-controllers-rhel8 +1
  • RHSA-2025:15673 Released 2025-09-18 · Red Hat rating Important
    OpenShift Container Platform 4.13.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8 +8
  • RHSA-2025:12323 Released 2025-08-07 · Red Hat rating Important
    OpenShift Container Platform 4.12.79 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-cluster-image-registry-operator, rhcos
  • RHSA-2025:11669 Released 2025-07-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-docker-registry, openshift4/ose-ibmcloud-cluster-api-controllers-rhel8, openshift4/ose-nutanix-machine-controllers-rhel8
  • RHSA-2025:11889 Released 2025-07-28 · Red Hat rating Important
    7.1 container image is now available in the Red Hat Ecosystem Catalog.
    • Red Hat Ceph Storage 7.1 Tools rhceph/grafana-rhel10, rhceph/grafana-rhel9, rhceph/keepalived-rhel9 +4
  • RHSA-2025:11830 Released 2025-07-28 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/odf-cli-rhel9
  • RHSA-2025:11749 Released 2025-07-24 · Red Hat rating Important
    Updated 8.1 container image is now available: security and bug fix update
    • Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9
  • RHSA-2025:11351 Released 2025-07-23 · Red Hat rating Important
    OpenShift Container Platform 4.15.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-nutanix-machine-controllers-rhel9, openshift4/ose-powervs-machine-controllers-rhel9
  • RHSA-2025:11396 Released 2025-07-18 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.4.5 security and bug fix update
    • 9Base-OADP-1.4 oadp/oadp-kubevirt-velero-plugin-rhel9, oadp/oadp-mustgather-rhel9, oadp/oadp-rhel9-operator +5
  • RHSA-2025:10781 Released 2025-07-17 · Red Hat rating Important
    OpenShift Container Platform 4.16.44 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2025:10294 Released 2025-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.35 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2025:9759 Released 2025-07-02 · Red Hat rating Important
    OpenShift Container Platform 4.14.53 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-cluster-image-registry-operator, openshift4/ose-cluster-openshift-apiserver-operator
  • RHSA-2025:9646 Released 2025-06-25 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.3.7 security and bug fix update
    • 9Base-OADP-1.3 oadp/oadp-kubevirt-velero-plugin-rhel9, oadp/oadp-mustgather-rhel9, oadp/oadp-rhel9-operator +6
  • RHSA-2025:9541 Released 2025-06-24 · Red Hat rating Important
    Submariner 0.17.6 bug fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2024:11038 Released 2025-06-17 · Red Hat rating Important
    OpenShift Container Platform 4.19.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 openshift4/ose-aws-ebs-csi-driver-rhel9, openshift4/ose-azure-disk-csi-driver-rhel9, openshift4/ose-azure-file-csi-driver-rhel9 +14
  • RHSA-2024:11037 Released 2025-06-17 · Red Hat rating Important
    OpenShift Container Platform 4.19.0 security and extras update
    • Red Hat OpenShift Container Platform 4.19 openshift4/ose-aws-efs-csi-driver-container-rhel9, openshift4/ose-gcp-filestore-csi-driver-rhel9, openshift4/ose-local-storage-diskmaker-rhel9 +3
  • RHSA-2025:9167 Released 2025-06-17 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.6.0 release
    • Red Hat OpenShift distributed tracing 3.6.0 registry.redhat.io/rhosdt/opentelemetry-rhel8-operator
  • RHSA-2025:8556 Released 2025-06-13 · Red Hat rating Important
    OpenShift Container Platform 4.16.42 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-cluster-image-registry-rhel9-operator, openshift4/ose-console-rhel9, openshift4/ose-docker-registry-rhel9 +1
  • RHSA-2025:8544 Released 2025-06-04 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.15.14 Bug Fix Update
    • RHODF 4.15 for RHEL 9 odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +2
  • RHSA-2025:8510 Released 2025-06-04 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.7 security and bug fix update
    • 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-ui-rhel8
  • RHSA-2025:8299 Released 2025-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.15.52 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-cluster-image-registry-rhel9-operator
  • RHSA-2025:8280 Released 2025-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.17.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2025:8284 Released 2025-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.18.16 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/azure-service-rhel9-operator +47
  • RHSA-2025:8390 Released 2025-06-02 · Red Hat rating Important
    Multicluster Engine for Kubernetes 2.4.9 security updates and bug fixes
    • multicluster engine for Kubernetes 2.4 for RHEL 8 multicluster-engine/addon-manager-rhel8, multicluster-engine/agent-service-rhel8, multicluster-engine/assisted-image-service-rhel8 +33
  • RHSA-2025:8274 Released 2025-05-28 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.14.4 security update
    • Red Hat OpenShift GitOps 1.14 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
  • RHSA-2025:7863 Released 2025-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.18.14 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-console-rhel9, openshift4/ose-nutanix-machine-controllers-rhel9
  • RHSA-2025:7753 Released 2025-05-15 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.15.2 security update
    • Red Hat OpenShift GitOps 1.15 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-extensions-rhel8, openshift-gitops-1/argocd-rhel8 +7
  • RHSA-2025:7616 Released 2025-05-14 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.3 Bug Fix Update
    • RHODF 4.18 for RHEL 9 odf4/cephcsi-operator-bundle, odf4/cephcsi-rhel9, odf4/cephcsi-rhel9-operator +29
  • RHSA-2025:7479 Released 2025-05-13 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.107.0-9.el10_0
  • RHSA-2025:7407 Released 2025-05-13 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.107.0-8.el9_6
  • RHSA-2025:4810 Released 2025-05-12 · Red Hat rating Important
    RHSA: Submariner 0.18.5 - bug and security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:4666 Released 2025-05-07 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.11.7 container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-grafana-rhel9, rhacm2/acm-prometheus-config-reloader-rhel9, rhacm2/acm-prometheus-rhel9 +16
  • RHSA-2025:4605 Released 2025-05-07 · Red Hat rating Important
    multicluster Engine for Kubernetes 2.6.7 container updates
    • multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-controller-rhel8 +2
    • multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/backplane-rhel9-operator +27
  • RHSA-2025:4511 Released 2025-05-06 · Red Hat rating Important
    RHODF-4.18-RHEL-9 security update
    • RHODF 4.18 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +7
  • RHSA-2025:4473 Released 2025-05-05 · Red Hat rating Important
    multicluster Engine for Kubernetes 2.5.9 container updates
    • multicluster engine for Kubernetes 2.5 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8 +3
    • multicluster engine for Kubernetes 2.5 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/apiserver-network-proxy-rhel9, multicluster-engine/aws-encryption-provider-rhel9 +29
  • RHSA-2025:4250 Released 2025-04-28 · Red Hat rating Important
    RHSA: Submariner 0.19.4 - bug fix and enhancement update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:4002 Released 2025-04-17 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.12.3 container image updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/acm-cli-rhel9, rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9 +43
  • RHSA-2025:3987 Released 2025-04-17 · Red Hat rating Important
    Multicluster Engine for Kubernetes 2.7.4 security updates
    • multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8
    • multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-image-service-rhel9, multicluster-engine/assisted-installer-agent-rhel9 +31
  • RHSA-2025:3790 Released 2025-04-17 · Red Hat rating Important
    OpenShift Container Platform 4.15.49 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-azure-workload-identity-webhook-rhel8, openshift4/ose-cloud-credential-operator, openshift4/ose-hypershift-rhel9
  • RHSA-2025:3959 Released 2025-04-16 · Red Hat rating Important
    VolSync 0.11.2 security fixes and enhancements for RHEL 9
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/volsync-operator-bundle, rhacm2/volsync-rhel9
  • RHSA-2025:3932 Released 2025-04-16 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.20.0 release
    • Red Hat OpenShift Dev Spaces 3 devspaces/devspaces-rhel9-operator, devspaces/pluginregistry-rhel9
  • RHSA-2025:3886 Released 2025-04-15 · Red Hat rating Important
    RHOAI 2.19.0 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.19 registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-model-controller-rhel8, registry.redhat.io/rhoai/odh-modelmesh-runtime-adapter-rhel8
  • RHSA-2025:3863 Released 2025-04-14 · Red Hat rating Important
    Red Hat multicluster global hub 1.3.3 bug fixes and container update
    • multicluster-globalhub 1.3 for RHEL 9 multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-kessel-inventory-api-rhel9 +4
  • RHSA-2025:3820 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/gitsign-rhel9
  • RHSA-2025:3814 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9, registry.redhat.io/rhtas/rekor-server-rhel9
  • RHSA-2025:3813 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/timestamp-authority-rhel9
  • RHSA-2025:3811 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/certificate-transparency-rhel9
  • RHSA-2025:3808 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/createtree-rhel9, registry.redhat.io/rhtas/trillian-database-rhel9, registry.redhat.io/rhtas/trillian-logserver-rhel9 +3
  • RHSA-2025:3763 Released 2025-04-09 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.13.2 container image updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 rhacm2/acm-cli-rhel9, rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-flightctl-api-rhel9 +47
  • RHSA-2025:3743 Released 2025-04-09 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.5.1 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel8, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8
  • RHSA-2025:3740 Released 2025-04-09 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8, registry.redhat.io/rhosdt/tempo-gateway-rhel8, registry.redhat.io/rhosdt/tempo-rhel8 +1
  • RHSA-2025:3720 Released 2025-04-08 · Red Hat rating Important
    multicluster engine for Kubernetes 2.8.1 container image updates
    • multicluster engine for Kubernetes 2.8 for RHEL 8 multicluster-engine/assisted-service-8-rhel8
    • multicluster engine for Kubernetes 2.8 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-image-service-rhel9, multicluster-engine/assisted-installer-agent-rhel9 +30
  • RHSA-2025:3593 Released 2025-04-03 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) opentelemetry-collector-0.107.0-7.el9_4
  • RHSA-2025:3503 Released 2025-04-02 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-db-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 +8
  • RHSA-2025:3498 Released 2025-04-01 · Red Hat rating Important
    Red Hat multicluster global hub 1.2.2 bug fixes and container update
    • multicluster-globalhub 1.2 for RHEL 9 multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9 +3
  • RHSA-2025:3501 Released 2025-04-01 · Red Hat rating Important
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.15.1-4 Update
    • Custom Metric Autoscaler operator for Red Hat Openshift 2.15 registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9
  • RHSA-2025:3439 Released 2025-04-01 · Red Hat rating Important
    ACS 4.6 enhancement and security update
    • RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2025:3437 Released 2025-04-01 · Red Hat rating Important
    ACS 4.5 enhancement and security update
    • RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2025:3335 Released 2025-03-27 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.107.0-8.el9_5
  • RHSA-2025:3172 Released 2025-03-25 · Red Hat rating Important
    VolSync 0.12.1 security fixes and enhancements for RHEL 9
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 rhacm2/volsync-operator-bundle, rhacm2/volsync-rhel9
  • RHSA-2025:3053 Released 2025-03-20 · Red Hat rating Important
    Gatekeeper v3.15.4
    • gatekeeper 3.15 for RHEL 9 gatekeeper/gatekeeper-operator-bundle, gatekeeper/gatekeeper-rhel9, gatekeeper/gatekeeper-rhel9-operator
  • RHSA-2025:3051 Released 2025-03-20 · Red Hat rating Important
    Gatekeeper v3.17.2
    • gatekeeper 3.17 for RHEL 9 gatekeeper/gatekeeper-operator-bundle, gatekeeper/gatekeeper-rhel9, gatekeeper/gatekeeper-rhel9-operator
  • RHSA-2025:2567 Released 2025-03-10 · Red Hat rating Important
    ACS 4.6 enhancement and security update
    • RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2025:2526 Released 2025-03-10 · Red Hat rating Important
    ACS 4.5 enhancement update
    • RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 3AffectedNo fix yet
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix yet
Migration Toolkit for Applications 7AffectedNo fix planned: Will not fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
OpenShift Service Mesh 3AffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ansible Automation Platform 1.2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 5AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat OpenShift Cluster Manager CLIAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
8Base-RHMTC-1.8Fixed RHSA-2025:8510
9Base-OADP-1.3Fixed RHSA-2025:9646
9Base-OADP-1.4Fixed RHSA-2025:11396
Cluster Observability Operator 1.5Fixed RHSA-2026:34342
Cryostat 4 on RHEL 9Fixed RHSA-2025:3503
Custom Metric Autoscaler operator for Red Hat Openshift 2.15Fixed RHSA-2025:3501
Logging Subsystem for Red Hat OpenShift 6.0Fixed RHSA-2025:23535
Logging Subsystem for Red Hat OpenShift 6.2Fixed RHSA-2025:23534
Logging for Red Hat OpenShift 6.3Fixed RHSA-2025:23057
Quay v3Fixed—
RHACS 4.5 for RHEL 8Fixed RHSA-2025:2526, RHSA-2025:3437
RHACS 4.6 for RHEL 8Fixed RHSA-2025:2567, RHSA-2025:3439
RHODF 4.15 for RHEL 9Fixed RHSA-2025:8544
RHODF 4.18 for RHEL 9Fixed RHSA-2025:4511, RHSA-2025:7616
Red Hat AI Inference Server 3.2Fixed RHSA-2025:23078, RHSA-2025:23079, RHSA-2025:23080, RHSA-2025:23202, RHSA-2025:23204, RHSA-2025:23205, RHSA-2025:23209, RHSA-2025:23449, RHSA-2026:3461, RHSA-2026:3462
Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9Fixed RHSA-2025:9541
Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9Fixed RHSA-2025:4666, RHSA-2025:4810
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9Fixed RHSA-2025:3959, RHSA-2025:4002, RHSA-2025:4250
Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9Fixed RHSA-2025:3172, RHSA-2025:3763
Red Hat Ceph Storage 7.1 ToolsFixed RHSA-2025:11889
Red Hat Ceph Storage 8.1 ToolsFixed RHSA-2025:11749
Red Hat Ceph Storage 9Fixed RHSA-2026:3406
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:7479
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:3335, RHSA-2025:7407
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:3593
Red Hat OpenShift AI 2.19Fixed RHSA-2025:3886
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2025:12323, RHSA-2025:17671
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:15673
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:11669, RHSA-2025:9759
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:11351, RHSA-2025:3790, RHSA-2025:8299
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:10781, RHSA-2025:8556
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:10294, RHSA-2025:8280
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:7863, RHSA-2025:8284
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2024:11037, RHSA-2024:11038
Red Hat OpenShift Dev Spaces 3Fixed RHSA-2025:3932
Red Hat OpenShift GitOps 1.14Fixed RHSA-2025:8274
Red Hat OpenShift GitOps 1.15Fixed RHSA-2025:7753
Red Hat OpenShift Pipelines 1.15Fixed RHSA-2026:3718
Red Hat OpenShift distributed tracing 3.5.3Fixed RHSA-2025:3740, RHSA-2025:3743
Red Hat OpenShift distributed tracing 3.6.0Fixed RHSA-2025:9167
Red Hat Openshift Data Foundation 4.15Fixed RHSA-2026:2172
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2026:2164
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2025:11830
Red Hat Trusted Artifact Signer 1.1Fixed RHSA-2025:3808, RHSA-2025:3811, RHSA-2025:3813, RHSA-2025:3814, RHSA-2025:3820
gatekeeper 3.15 for RHEL 9Fixed RHSA-2025:3053
gatekeeper 3.17 for RHEL 9Fixed RHSA-2025:3051
multicluster engine for Kubernetes 2.4 for RHEL 8Fixed RHSA-2025:8390
multicluster engine for Kubernetes 2.5 for RHEL 8Fixed RHSA-2025:4473
multicluster engine for Kubernetes 2.5 for RHEL 9Fixed RHSA-2025:4473
multicluster engine for Kubernetes 2.6 for RHEL 8Fixed RHSA-2025:4605
multicluster engine for Kubernetes 2.6 for RHEL 9Fixed RHSA-2025:4605
multicluster engine for Kubernetes 2.7 for RHEL 8Fixed RHSA-2025:3987
multicluster engine for Kubernetes 2.7 for RHEL 9Fixed RHSA-2025:3987
multicluster engine for Kubernetes 2.8 for RHEL 8Fixed RHSA-2025:3720
multicluster engine for Kubernetes 2.8 for RHEL 9Fixed RHSA-2025:3720
multicluster-globalhub 1.2 for RHEL 9Fixed RHSA-2025:3498
multicluster-globalhub 1.3 for RHEL 9Fixed RHSA-2025:3863
Not affected: 45 products
  • 8Base-RHMTC-1.8
  • 9Base-OADP-1.3
  • 9Base-OADP-1.4
  • Cluster Observability Operator 1.5
  • Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • Logging Subsystem for Red Hat OpenShift
  • Logging Subsystem for Red Hat OpenShift 6.0
  • Logging Subsystem for Red Hat OpenShift 6.2
  • Logging for Red Hat OpenShift 6.3
  • Migration Toolkit for Virtualization
  • Node Maintenance Operator
  • OpenShift Service Mesh 2
  • RHODF 4.15 for RHEL 9
  • RHODF 4.18 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
  • Red Hat Ceph Storage 8
  • Red Hat Ceph Storage 8.1 Tools
  • Red Hat Ceph Storage 9
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI 2.19
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3
  • Red Hat OpenShift Pipelines 1.15
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3.5.3
  • Red Hat OpenShift distributed tracing 3.6.0
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Openshift Data Foundation 4.15
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Service Interconnect 1
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.1
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22868
  2. 2026-10-03 Alias added: GHSA-6v2p-p543-phr9
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-16 Fix available: Logging Subsystem for Red Hat OpenShift 6.0 · Red Hat
  5. 2026-11-04 Fix available: RHSA-2025:4002 · Red Hat
  6. 2026-11-04 Fix available: RHSA-2025:4473 · Red Hat
  7. 2026-11-04 Fix available: RHSA-2025:7616 · Red Hat
  8. 2026-11-04 Fix available: RHSA-2025:7863 · Red Hat
  9. 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat

References

Patch 2

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences