Read the docs
TI-2025-21540 Aliases CVE-2025-30204GHSA-mh63-6h87-95cp

jwt-go allows excessive memory allocation during header parsing

Priority MEDIUM 40CWE-405Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 67 fixed, 19 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00811 57th percentileScored 2026-11-07
Fix Partial jwt (golang-jwt): 4.5.2, 5.2.2github.com/golang-jwt/jwt/v5 (Go): 5.2.2+1 more productRed Hat: 107 advisoriesRed Hat: 67 fixed, 19 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
golang-jwtjwt3.2.0 to before 4.5.2; 5.0.0-rc.1 to before 5.2.24.5.2, 5.2.2Patch availableCNA
—github.com/golang-jwt/jwt/v5 (Go)5.0.0-rc.1 to before 5.2.25.2.2Patch availableGHSA-mh63-6h87-95cp
—github.com/golang-jwt/jwt/v4 (Go)before 4.5.24.5.2Patch availableGHSA-mh63-6h87-95cp
—github.com/golang-jwt/jwt (Go)3.2.0 – 3.2.2—No fix listedGHSA-mh63-6h87-95cp
  • jwt Vendorgolang-jwt Affected 3.2.0 to before 4.5.2; 5.0.0-rc.1 to before 5.2.2 Fixed in 4.5.2, 5.2.2 Patch available CNA
  • github.com/golang-jwt/jwt/v5 (Go) Vendor— Affected 5.0.0-rc.1 to before 5.2.2 Fixed in 5.2.2 Patch available GHSA-mh63-6h87-95cp
  • github.com/golang-jwt/jwt/v4 (Go) Vendor— Affected before 4.5.2 Fixed in 4.5.2 Patch available GHSA-mh63-6h87-95cp
  • github.com/golang-jwt/jwt (Go) Vendor— Affected 3.2.0 – 3.2.2 Fixed in — No fix listed GHSA-mh63-6h87-95cp

Remediation

  • Fix · CNA jwt (golang-jwt) Fixed in 4.5.2, 5.2.2
  • Fix · GHSA-mh63-6h87-95cp github.com/golang-jwt/jwt/v5 (Go) Fixed in 5.2.2 Advisory →
  • Fix · GHSA-mh63-6h87-95cp github.com/golang-jwt/jwt/v4 (Go) Fixed in 4.5.2 Advisory →

Red Hat 107 advisories

  • RHSA-2026:67858 Released 2026-09-24 · Red Hat rating Important
    OpenShift Container Platform 4.15.69 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/ose-cli-artifacts, registry.redhat.io/openshift4/ose-cluster-config-api-rhel9, registry.redhat.io/openshift4/ose-cluster-openshift-controller-manager-rhel9-operator +10
  • RHSA-2026:67936 Released 2026-09-24 · Red Hat rating Important
    OpenShift Container Platform 4.16.71 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:59579 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.14 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +17
Show 104 more Red Hat advisories
  • RHSA-2026:59558 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.10 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9 +20
  • RHSA-2026:3718 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.4
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel8
  • RHSA-2026:2172 Released 2026-02-05 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.15 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:2164 Released 2026-02-05 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:2155 Released 2026-02-05 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:1536 Released 2026-01-29 · Red Hat rating Moderate
    Red Hat Ceph Storage 9.0 Security and Enhancement update
    • Red Hat Ceph Storage 9.0 Tools ceph-2:20.1.0-144.el10cp, ceph-2:20.1.0-144.el9cp, ceph-base-2:20.1.0-144.el10cp +47
  • RHSA-2026:0722 Released 2026-01-15 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.4 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9 +14
  • RHSA-2025:23916 Released 2025-12-22 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2025:23535 Released 2025-12-17 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.12
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/logging-loki-rhel9
  • RHSA-2025:23534 Released 2025-12-17 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.2.7
    • Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/logging-loki-rhel9
  • RHSA-2025:23057 Released 2025-12-10 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.3.2
    • Logging for Red Hat OpenShift 6.3 registry.redhat.io/openshift-logging/logging-loki-rhel9
  • RHSA-2025:18241 Released 2025-10-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.61 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-powervs-machine-controllers-rhel8
  • RHSA-2025:18242 Released 2025-10-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.61 security and extras update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-operator-sdk-rhel8, registry.redhat.io/openshift4/ose-sriov-network-operator
  • RHSA-2025:17671 Released 2025-10-16 · Red Hat rating Important
    OpenShift Container Platform 4.12.81 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-coredns, registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel8, registry.redhat.io/openshift4/ose-nutanix-machine-controllers-rhel8 +1
  • RHSA-2025:16595 Released 2025-09-24 · Red Hat rating Important
    VolSync v0.13 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/volsync-rhel9
  • RHSA-2025:15673 Released 2025-09-18 · Red Hat rating Important
    OpenShift Container Platform 4.13.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8 +8
  • RHSA-2025:15872 Released 2025-09-15 · Red Hat rating Important
    VolSync v0.12 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/volsync-rhel9
  • RHSA-2025:15332 Released 2025-09-11 · Red Hat rating Important
    OpenShift Container Platform 4.12.80 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8 +6
  • RHSA-2025:14855 Released 2025-09-04 · Red Hat rating Important
    OpenShift Container Platform 4.14.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-cluster-image-registry-operator, registry.redhat.io/openshift4/ose-coredns, registry.redhat.io/openshift4/ose-multus-admission-controller +1
  • RHSA-2025:14048 Released 2025-08-18 · Red Hat rating Important
    Red Hat OpenShift for Windows Containers 10.19.0 product release
    • Red Hat OpenShift for Windows Containers 10.19 registry.redhat.io/openshift4-wincw/windows-machine-config-operator-bundle
  • RHSA-2025:11669 Released 2025-07-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-docker-registry, openshift4/ose-ibmcloud-cluster-api-controllers-rhel8, openshift4/ose-nutanix-machine-controllers-rhel8
  • RHSA-2025:11681 Released 2025-07-30 · Red Hat rating Important
    OpenShift Container Platform 4.16.45 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2025:11749 Released 2025-07-24 · Red Hat rating Important
    Updated 8.1 container image is now available: security and bug fix update
    • Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9
  • RHSA-2025:11573 Released 2025-07-23 · Red Hat rating Important
    Multicluster engine for Kubernetes 2.7.5 security updates and bug fixes
    • multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8
    • multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-image-service-rhel9, multicluster-engine/assisted-installer-agent-rhel9 +31
  • RHSA-2025:11396 Released 2025-07-18 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.4.5 security and bug fix update
    • 9Base-OADP-1.4 oadp/oadp-kubevirt-velero-plugin-rhel9, oadp/oadp-mustgather-rhel9, oadp/oadp-rhel9-operator +5
  • RHSA-2025:9259 Released 2025-06-26 · Red Hat rating Important
    OpenShift Container Platform 4.15.53 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-cluster-image-registry-rhel9-operator, openshift4/ose-docker-registry-rhel9
  • RHSA-2025:9646 Released 2025-06-25 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.3.7 security and bug fix update
    • 9Base-OADP-1.3 oadp/oadp-kubevirt-velero-plugin-rhel9, oadp/oadp-mustgather-rhel9, oadp/oadp-rhel9-operator +6
  • RHSA-2025:9541 Released 2025-06-24 · Red Hat rating Important
    Submariner 0.17.6 bug fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:9388 Released 2025-06-23 · Red Hat rating Important
    Red Hat Multicluster GlobalHub 1.2.3 bug fixes and container updates
    • multicluster-globalhub 1.2 for RHEL 9 multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9 +3
  • RHSA-2025:9167 Released 2025-06-17 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.6.0 release
    • Red Hat OpenShift distributed tracing 3.6.0 registry.redhat.io/rhosdt/opentelemetry-rhel8-operator
  • RHSA-2025:8556 Released 2025-06-13 · Red Hat rating Important
    OpenShift Container Platform 4.16.42 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-cluster-image-registry-rhel9-operator, openshift4/ose-console-rhel9, openshift4/ose-docker-registry-rhel9 +1
  • RHSA-2025:8552 Released 2025-06-11 · Red Hat rating Important
    OpenShift Container Platform 4.17.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/ose-cluster-image-registry-rhel9-operator, openshift4/ose-docker-registry-rhel9
  • RHSA-2025:8560 Released 2025-06-10 · Red Hat rating Important
    OpenShift Container Platform 4.18.17 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-cluster-image-registry-rhel9-operator, openshift4/ose-docker-registry-rhel9
  • RHSA-2025:8691 Released 2025-06-09 · Red Hat rating Important
    RHSA: Submariner 0.20.1 - bug fix and enhancement update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:8303 Released 2025-06-05 · Red Hat rating Important
    OpenShift Container Platform 4.12.77 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/driver-toolkit-rhel8, openshift4/network-tools-rhel8, openshift4/ose-baremetal-installer-rhel8 +17
  • RHSA-2025:8542 Released 2025-06-04 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.13.3 fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 rhacm2/acm-cli-rhel9, rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-flightctl-api-rhel9 +47
  • RHSA-2025:8544 Released 2025-06-04 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.15.14 Bug Fix Update
    • RHODF 4.15 for RHEL 9 odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +2
  • RHSA-2025:8510 Released 2025-06-04 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.7 security and bug fix update
    • 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-ui-rhel8
  • RHSA-2025:8479 Released 2025-06-04 · Red Hat rating Important
    RHODF-4.16-RHEL-9 security update
    • RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +4
  • RHSA-2025:8392 Released 2025-06-04 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.9.9 bug fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/acm-cluster-permission-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-governance-policy-framework-addon-rhel8 +41
  • RHSA-2025:8390 Released 2025-06-02 · Red Hat rating Important
    Multicluster Engine for Kubernetes 2.4.9 security updates and bug fixes
    • multicluster engine for Kubernetes 2.4 for RHEL 8 multicluster-engine/addon-manager-rhel8, multicluster-engine/agent-service-rhel8, multicluster-engine/assisted-image-service-rhel8 +33
  • RHSA-2025:8384 Released 2025-06-02 · Red Hat rating Important
    Red Hat multicluster global hub 1.4.1 bug fixes and container updates
    • multicluster-globalhub 1.4 for RHEL 9 multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-kessel-inventory-api-rhel9 +4
  • RHSA-2025:8274 Released 2025-05-28 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.14.4 security update
    • Red Hat OpenShift GitOps 1.14 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
  • RHSA-2025:8267 Released 2025-05-28 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) osbuild-composer-46.3-3.el9_0, osbuild-composer-core-46.3-3.el9_0, osbuild-composer-dnf-json-46.3-3.el9_0 +1
  • RHSA-2025:8244 Released 2025-05-28 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.21.0 release
    • Red Hat OpenShift Dev Spaces 3 devspaces-tech-preview/idea-rhel9, devspaces-tech-preview/jetbrains-ide-rhel9, devspaces/code-rhel9 +11
  • RHSA-2025:8075 Released 2025-05-21 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) osbuild-composer-75-3.el8_8, osbuild-composer-core-75-3.el8_8, osbuild-composer-dnf-json-75-3.el8_8 +1
  • RHSA-2025:7702 Released 2025-05-21 · Red Hat rating Important
    OpenShift Container Platform 4.14.52 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel8, openshift4/ose-hypershift-rhel8 +1
  • RHSA-2025:8059 Released 2025-05-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.7 Bug Fix Update
    • RHODF 4.17 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +8
  • RHSA-2025:7967 Released 2025-05-19 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-101-3.el8_10, osbuild-composer-core-101-3.el8_10, osbuild-composer-worker-101-3.el8_10
  • RHSA-2025:7753 Released 2025-05-15 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.15.2 security update
    • Red Hat OpenShift GitOps 1.15 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-extensions-rhel8, openshift-gitops-1/argocd-rhel8 +7
  • RHSA-2025:4677 Released 2025-05-15 · Red Hat rating Important
    OpenShift Container Platform 4.13.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-agent-installer-node-agent-rhel8, openshift4/ose-agent-installer-orchestrator-rhel8 +6
  • RHSA-2025:4731 Released 2025-05-15 · Red Hat rating Important
    OpenShift Container Platform 4.16.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/driver-toolkit-rhel9, openshift4/network-tools-rhel9, openshift4/openshift-route-controller-manager-rhel9 +30
  • RHSA-2025:7503 Released 2025-05-13 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 10) osbuild-composer-134.1-1.el10_0, osbuild-composer-core-134.1-1.el10_0, osbuild-composer-worker-134.1-1.el10_0
  • RHSA-2025:7479 Released 2025-05-13 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.107.0-9.el10_0
  • RHSA-2025:7475 Released 2025-05-13 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 10) grafana-10.2.6-15.el10_0, grafana-selinux-10.2.6-15.el10_0
  • RHSA-2025:7404 Released 2025-05-13 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-11.el9_6, grafana-selinux-10.2.6-11.el9_6
  • RHSA-2025:7425 Released 2025-05-13 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-132.2-1.el9_6, osbuild-composer-core-132.2-1.el9_6, osbuild-composer-worker-132.2-1.el9_6
  • RHSA-2025:7407 Released 2025-05-13 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.107.0-8.el9_6
  • RHSA-2025:4810 Released 2025-05-12 · Red Hat rating Important
    RHSA: Submariner 0.18.5 - bug and security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:4422 Released 2025-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.15.50 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel8, openshift4/ose-baremetal-rhel9-operator +4
  • RHSA-2025:4409 Released 2025-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.12.76 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-baremetal-rhel8-operator, openshift4/ose-ibm-vpc-block-csi-driver-rhel8 +2
  • RHSA-2025:4666 Released 2025-05-07 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.11.7 container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-grafana-rhel9, rhacm2/acm-prometheus-config-reloader-rhel9, rhacm2/acm-prometheus-rhel9 +16
  • RHSA-2025:4669 Released 2025-05-07 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-118.2-1.el9_5, osbuild-composer-core-118.2-1.el9_5, osbuild-composer-worker-118.2-1.el9_5
  • RHSA-2025:4569 Released 2025-05-06 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) osbuild-composer-76.1-1.el9_2, osbuild-composer-core-76.1-1.el9_2, osbuild-composer-dnf-json-76.1-1.el9_2 +1
  • RHSA-2025:4511 Released 2025-05-06 · Red Hat rating Important
    RHODF-4.18-RHEL-9 security update
    • RHODF 4.18 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +7
  • RHSA-2025:4502 Released 2025-05-06 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.10.8 container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9 +41
  • RHSA-2025:4473 Released 2025-05-05 · Red Hat rating Important
    multicluster Engine for Kubernetes 2.5.9 container updates
    • multicluster engine for Kubernetes 2.5 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8 +3
    • multicluster engine for Kubernetes 2.5 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/apiserver-network-proxy-rhel9, multicluster-engine/aws-encryption-provider-rhel9 +29
  • RHSA-2025:4462 Released 2025-05-05 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) osbuild-composer-101.3-1.el9_4, osbuild-composer-core-101.3-1.el9_4, osbuild-composer-worker-101.3-1.el9_4
  • RHSA-2025:4211 Released 2025-05-01 · Red Hat rating Important
    OpenShift Container Platform 4.18.11 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-cluster-etcd-rhel9-operator, openshift4/ose-olm-operator-controller-rhel9, rhcos
  • RHSA-2025:4177 Released 2025-04-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.51 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-baremetal-rhel8-operator, openshift4/ose-cluster-etcd-rhel8-operator +4
  • RHSA-2025:4204 Released 2025-04-30 · Red Hat rating Important
    OpenShift Container Platform 4.17.27 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/ose-cluster-etcd-rhel9-operator, openshift4/ose-oauth-proxy-rhel9
  • RHSA-2025:4250 Released 2025-04-28 · Red Hat rating Important
    RHSA: Submariner 0.19.4 - bug fix and enhancement update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:4188 Released 2025-04-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.2
    • Builds for Red Hat OpenShift 1.2.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +3
  • RHSA-2025:4171 Released 2025-04-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.3
    • Builds for Red Hat OpenShift 1.3.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +3
  • RHSA-2025:4012 Released 2025-04-23 · Red Hat rating Important
    OpenShift Container Platform 4.17.26 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/ose-agent-installer-orchestrator-rhel9, openshift4/ose-hypershift-rhel9, openshift4/ose-ibm-vpc-block-csi-driver-rhel9 +2
  • RHSA-2025:4008 Released 2025-04-23 · Red Hat rating Important
    OpenShift Container Platform 4.16.39 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2025:4019 Released 2025-04-22 · Red Hat rating Important
    OpenShift Container Platform 4.18.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-ibm-vpc-block-csi-driver-rhel9, openshift4/ose-monitoring-plugin-rhel9, openshift4/ose-operator-registry-rhel9 +1
  • RHSA-2025:3993 Released 2025-04-17 · Red Hat rating Important
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.15.1-6 Update
    • Custom Metric Autoscaler operator for Red Hat Openshift 2.15 registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9
  • RHSA-2025:3790 Released 2025-04-17 · Red Hat rating Important
    OpenShift Container Platform 4.15.49 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-azure-workload-identity-webhook-rhel8, openshift4/ose-cloud-credential-operator, openshift4/ose-hypershift-rhel9
  • RHSA-2025:3907 Released 2025-04-16 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.1.5
    • RHOL 6.1 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +7
  • RHSA-2025:3798 Released 2025-04-16 · Red Hat rating Important
    OpenShift Container Platform 4.17.25 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/azure-kms-encryption-provider-rhel9, openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-aws-cluster-api-controllers-rhel9 +2
  • RHSA-2025:3905 Released 2025-04-16 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.7
    • RHOL 6.0 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +7
  • RHSA-2025:3906 Released 2025-04-16 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.9.13
    • RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
  • RHSA-2025:3775 Released 2025-04-16 · Red Hat rating Important
    OpenShift Container Platform 4.18.9 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/azure-kms-encryption-provider-rhel9, openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel9 +4
  • RHSA-2025:3930 Released 2025-04-15 · Red Hat rating Important
    RHACS 4.7 security update
    • RHACS 4.7 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-main-rhel8 +9
  • RHSA-2025:3929 Released 2025-04-15 · Red Hat rating Important
    ACS 4.6 enhancement and security update
    • RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2025:3928 Released 2025-04-15 · Red Hat rating Important
    ACS 4.5 enhancement and security update
    • RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2025:3820 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/gitsign-rhel9
  • RHSA-2025:3814 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9, registry.redhat.io/rhtas/rekor-server-rhel9
  • RHSA-2025:3813 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/timestamp-authority-rhel9
  • RHSA-2025:3811 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/certificate-transparency-rhel9
  • RHSA-2025:3808 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/createtree-rhel9, registry.redhat.io/rhtas/trillian-database-rhel9, registry.redhat.io/rhtas/trillian-logserver-rhel9 +3
  • RHSA-2025:3577 Released 2025-04-10 · Red Hat rating Important
    OpenShift Container Platform 4.18.8 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-aws-cluster-api-controllers-rhel9, openshift4/ose-azure-workload-identity-webhook-rhel9, openshift4/ose-cloud-credential-rhel9-operator +1
  • RHSA-2025:3569 Released 2025-04-09 · Red Hat rating Important
    OpenShift Container Platform 4.14.50 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-azure-workload-identity-webhook-rhel8, openshift4/ose-cloud-credential-operator, rhcos
  • RHSA-2025:3743 Released 2025-04-09 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.5.1 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel8, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8
  • RHSA-2025:3740 Released 2025-04-09 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8, registry.redhat.io/rhosdt/tempo-gateway-rhel8, registry.redhat.io/rhosdt/tempo-rhel8 +1
  • RHSA-2025:3565 Released 2025-04-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.24 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/ose-azure-workload-identity-webhook-rhel9, openshift4/ose-cloud-credential-rhel9-operator
  • RHSA-2025:3698 Released 2025-04-08 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) opentelemetry-collector-0.107.0-8.el9_4
  • RHSA-2025:3618 Released 2025-04-07 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) grafana-9.2.10-22.el9_4, grafana-selinux-9.2.10-22.el9_4
  • RHSA-2025:3616 Released 2025-04-07 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) grafana-9.0.9-6.el9_2
  • RHSA-2025:3607 Released 2025-04-04 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/tempo-gateway-rhel8, registry.redhat.io/rhosdt/tempo-rhel8-operator
  • RHSA-2025:3503 Released 2025-04-02 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-db-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 +8
  • RHSA-2025:3411 Released 2025-03-31 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.107.0-10.el9_5
  • RHSA-2025:3344 Released 2025-03-27 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-9.el9_5, grafana-selinux-10.2.6-9.el9_5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Cryostat 3AffectedNo fix planned: Out of support scope
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix yet
Migration Toolkit for Applications 7AffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 5AffectedNo fix planned: Out of support scope
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Cluster Manager CLIAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift Update ServiceAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
8Base-RHMTC-1.8Fixed RHSA-2025:8510
9Base-OADP-1.3Fixed RHSA-2025:9646
9Base-OADP-1.4Fixed RHSA-2025:11396
Builds for Red Hat OpenShift 1.2.2Fixed RHSA-2025:4188
Builds for Red Hat OpenShift 1.3.2Fixed RHSA-2025:4171
Cryostat 4 on RHEL 9Fixed RHSA-2025:3503
Custom Metric Autoscaler operator for Red Hat Openshift 2.15Fixed RHSA-2025:3993
Logging Subsystem for Red Hat OpenShift 6.0Fixed RHSA-2025:23535
Logging Subsystem for Red Hat OpenShift 6.2Fixed RHSA-2025:23534
Logging for Red Hat OpenShift 6.3Fixed RHSA-2025:23057
RHACS 4.5 for RHEL 8Fixed RHSA-2025:3928
RHACS 4.6 for RHEL 8Fixed RHSA-2025:3929
RHACS 4.7 for RHEL 8Fixed RHSA-2025:3930
RHODF 4.15 for RHEL 9Fixed RHSA-2025:8544
RHODF 4.16 for RHEL 9Fixed RHSA-2025:8479
RHODF 4.17 for RHEL 9Fixed RHSA-2025:8059
RHODF 4.18 for RHEL 9Fixed RHSA-2025:4511
RHOL 5.9 for RHEL 9Fixed RHSA-2025:3906
RHOL 6.0 for RHEL 9Fixed RHSA-2025:3905
RHOL 6.1 for RHEL 9Fixed RHSA-2025:3907
Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9Fixed RHSA-2025:4502, RHSA-2025:9541
Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9Fixed RHSA-2025:4666, RHSA-2025:4810
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9Fixed RHSA-2025:4250
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2025:15872
Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9Fixed RHSA-2025:8542, RHSA-2025:8691
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2025:16595
Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8Fixed RHSA-2025:8392
Red Hat Ceph Storage 8.1 ToolsFixed RHSA-2025:11749
Red Hat Ceph Storage 9.0 ToolsFixed RHSA-2026:1536
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:7475, RHSA-2025:7479, RHSA-2025:7503
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:7967
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:3344, RHSA-2025:3411, RHSA-2025:4669, RHSA-2025:7404, RHSA-2025:7407, RHSA-2025:7425
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:8267
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2025:8075
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2025:3616, RHSA-2025:4569
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:3618, RHSA-2025:3698, RHSA-2025:4462
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2025:15332, RHSA-2025:17671, RHSA-2025:4409, RHSA-2025:8303
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:15673, RHSA-2025:18241, RHSA-2025:18242, RHSA-2025:4677
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:11669, RHSA-2025:14855, RHSA-2025:3569, RHSA-2025:4177, RHSA-2025:7702
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:3790, RHSA-2025:4422, RHSA-2025:9259, RHSA-2026:67858
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:11681, RHSA-2025:4008, RHSA-2025:4731, RHSA-2025:8556, RHSA-2026:67936
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:3565, RHSA-2025:3798, RHSA-2025:4012, RHSA-2025:4204, RHSA-2025:8552
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:3577, RHSA-2025:3775, RHSA-2025:4019, RHSA-2025:4211, RHSA-2025:8560
Red Hat OpenShift Dev Spaces 3Fixed RHSA-2025:8244
Red Hat OpenShift GitOps 1.14Fixed RHSA-2025:8274
Red Hat OpenShift GitOps 1.15Fixed RHSA-2025:7753
Red Hat OpenShift Pipelines 1.15Fixed RHSA-2026:3718
Red Hat OpenShift Service on AWS 1.0Fixed—
Red Hat OpenShift distributed tracing 3.5.3Fixed RHSA-2025:3607, RHSA-2025:3740, RHSA-2025:3743
Red Hat OpenShift distributed tracing 3.6.0Fixed RHSA-2025:9167
Red Hat OpenShift for Windows Containers 10.19Fixed RHSA-2025:14048
Red Hat Openshift Data Foundation 4.15Fixed RHSA-2026:2172
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2026:2164
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:2155
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2025:23916
Red Hat Trusted Artifact Signer 1.1Fixed RHSA-2025:3808, RHSA-2025:3811, RHSA-2025:3813, RHSA-2025:3814, RHSA-2025:3820
multicluster engine for Kubernetes 2.4 for RHEL 8Fixed RHSA-2025:8390
multicluster engine for Kubernetes 2.5 for RHEL 8Fixed RHSA-2025:4473
multicluster engine for Kubernetes 2.5 for RHEL 9Fixed RHSA-2025:4473
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:59579
multicluster engine for Kubernetes 2.6 for RHEL 8Fixed RHSA-2025:13900
multicluster engine for Kubernetes 2.6 for RHEL 9Fixed RHSA-2025:13900
multicluster engine for Kubernetes 2.7 for RHEL 8Fixed RHSA-2025:11573
multicluster engine for Kubernetes 2.7 for RHEL 9Fixed RHSA-2025:11573
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:0722, RHSA-2026:59558
multicluster-globalhub 1.2 for RHEL 9Fixed RHSA-2025:9388
multicluster-globalhub 1.4 for RHEL 9Fixed RHSA-2025:8384
Not affected: 45 products
  • 8Base-RHMTC-1.8
  • 9Base-OADP-1.3
  • 9Base-OADP-1.4
  • Builds for Red Hat OpenShift 1.2.2
  • Builds for Red Hat OpenShift 1.3.2
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • Logging Subsystem for Red Hat OpenShift 6.0
  • Logging Subsystem for Red Hat OpenShift 6.2
  • Logging for Red Hat OpenShift 6.3
  • Node Maintenance Operator
  • OpenShift Developer Tools and Services
  • RHODF 4.15 for RHEL 9
  • RHODF 4.16 for RHEL 9
  • RHODF 4.17 for RHEL 9
  • RHODF 4.18 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ceph Storage 8.1 Tools
  • Red Hat Ceph Storage 9.0 Tools
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Pipelines 1.15
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenShift distributed tracing 3.5.3
  • Red Hat OpenShift distributed tracing 3.6.0
  • Red Hat OpenShift for Windows Containers 10.19
  • Red Hat Openshift Data Foundation 4.15
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.1
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-30204
  2. 2026-10-03 Alias added: GHSA-mh63-6h87-95cp
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-13 Fix available: Red Hat OpenShift for Windows Containers 10.19 · Red Hat
  5. 2026-10-16 Fix available: Logging Subsystem for Red Hat OpenShift 6.0 · Red Hat
  6. 2026-10-30 Affected versions changed · Red Hat
  7. 2026-11-04 Fix available: RHSA-2025:4008 · Red Hat
  8. 2026-11-04 Fix available: RHSA-2025:4177 · Red Hat
  9. 2026-11-04 Fix available: RHSA-2025:4188 · Red Hat
  10. 2026-11-04 Fix available: RHSA-2025:4422 · Red Hat
  11. 2026-11-04 Fix available: RHSA-2025:4409 · Red Hat
  12. 2026-11-04 Fix available: RHSA-2025:4473 · Red Hat
  13. 2026-11-04 Fix available: RHSA-2025:4502 · Red Hat
  14. 2026-11-04 Fix available: RHSA-2025:4569 · Red Hat
  15. 2026-11-04 Fix available: RHSA-2025:7475 · Red Hat
  16. 2026-11-04 Fix available: RHSA-2025:7702 · Red Hat
  17. 2026-11-04 Fix available: RHSA-2025:8075 · Red Hat
  18. 2026-11-04 Fix available: RHSA-2025:8542 · Red Hat
  19. 2026-11-04 Fix available: RHSA-2025:8560 · Red Hat
  20. 2026-11-04 Fix available: RHSA-2025:8691 · Red Hat

References

Advisory 1

Other 5

  • TI-2024-34649 Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt CVSS 3.1LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences