Read the docs
TI-2025-30311 Aliases CVE-2025-47907GHSA-j5pm-7495-qmr3

Incorrect results returned from Rows.Scan in database/sql

Priority LOW 31CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Partial Red Hat: 46 fixed, 47 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00406 35th percentileScored 2026-11-07
Fix Partial database/sql (Go standard library): 1.23.12, 1.24.6Red Hat: 61 advisoriesRed Hat: 46 fixed, 47 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarydatabase/sqlbefore 1.23.12; 1.24.0 to before 1.24.61.23.12, 1.24.6Patch availableCNA
  • database/sql VendorGo standard library Affected before 1.23.12; 1.24.0 to before 1.24.6 Fixed in 1.23.12, 1.24.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.23.12; 1.24.0 to before 1.24.6VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.23.12; 1.24.0 to before 1.24.6 Vulnerable ·Go standard library

Remediation

  • Fix · CNA database/sql (Go standard library) Fixed in 1.23.12, 1.24.6

Red Hat 61 advisories

  • RHSA-2026:94074 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.14.2 release.
    • Red Hat Web Terminal 1.14 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94072 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.11.3 release.
    • Red Hat Web Terminal 1.11 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94070 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.13.2 release.
    • Red Hat Web Terminal 1.13 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
Show 58 more Red Hat advisories
  • RHSA-2026:67539 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7
  • RHSA-2026:59451 Released 2026-08-25 · Red Hat rating Moderate
    RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-rhel9-operator
  • RHSA-2026:59439 Released 2026-08-25 · Red Hat rating Important
    RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +5
  • RHSA-2026:59433 Released 2026-08-25 · Red Hat rating Moderate
    RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rekor-cli-rhel9, registry.redhat.io/rhtas/updatetree-rhel9
  • RHSA-2026:59431 Released 2026-08-25 · Red Hat rating Moderate
    RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/createtree-rhel9
  • RHSA-2026:56347 Released 2026-08-18 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-analyzer-addon-rhel9, registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-discovery-addon-rhel9 +4
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
  • RHSA-2026:8218 Released 2026-04-15 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.5 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5
  • RHSA-2026:6226 Released 2026-03-31 · Red Hat rating Important
    Multicluster Global Hub 1.6.2 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:5107 Released 2026-03-26 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.63 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:5645 Released 2026-03-24 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.1
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:5636 Released 2026-03-24 · Red Hat rating Important
    multicluster engine for Kubernetes v2.7.9 security update
    • multicluster engine for Kubernetes 2.7 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:5633 Released 2026-03-24 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.12.8 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9 +23
  • RHSA-2026:4482 Released 2026-03-19 · Red Hat rating Moderate
    OpenShift Container Platform 4.16.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:4423 Released 2026-03-19 · Red Hat rating Important
    OpenShift Container Platform 4.15.62 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2026:4510 Released 2026-03-19 · Red Hat rating Important
    OpenShift Container Platform 4.17.51 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:4434 Released 2026-03-18 · Red Hat rating Important
    OpenShift Container Platform 4.19.26 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:3905 Released 2026-03-11 · Red Hat rating Important
    OpenShift Container Platform 4.18.35 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
  • RHSA-2026:2951 Released 2026-02-18 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:2737 Released 2026-02-16 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:2572 Released 2026-02-11 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/config-policy-controller-rhel9 +16
  • RHSA-2026:2571 Released 2026-02-11 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.2 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +8
  • RHSA-2026:2351 Released 2026-02-09 · Red Hat rating Moderate
    VolSync v0.13 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/volsync-rhel9
  • RHSA-2026:2155 Released 2026-02-05 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:1942 Released 2026-02-04 · Red Hat rating Important
    Red Hat Quay 3.15.3
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1084 Released 2026-01-26 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) podman-5:5.4.0-18.el9_6, podman-docker-5:5.4.0-18.el9_6, podman-plugins-5:5.4.0-18.el9_6 +2
  • RHSA-2026:1071 Released 2026-01-25 · Red Hat rating Moderate
    multicluster engine for Kubernetes v2.10.1 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9 +3
  • RHSA-2026:0722 Released 2026-01-15 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.4 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9 +14
  • RHSA-2026:0718 Released 2026-01-15 · Red Hat rating Important
    Moderate: Red Hat Advanced Cluster Management for Kubernetes v2.13.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9 +24
  • RHSA-2026:0627 Released 2026-01-14 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9 +19
  • RHSA-2025:23916 Released 2025-12-22 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2025:23248 Released 2025-12-16 · Red Hat rating Important
    RHSA 4.7.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.7 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2025:22759 Released 2025-12-04 · Red Hat rating Important
    RHOAI 2.22.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.22 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9 +8
  • RHSA-2025:22684 Released 2025-12-03 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +5
  • RHSA-2025:22179 Released 2025-11-26 · Red Hat rating Moderate
    RHSA 4.8.6 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2025:21148 Released 2025-11-25 · Red Hat rating Moderate
    Red Hat build of Cryostat 4.1.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-db-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 +7
  • RHSA-2025:21384 Released 2025-11-13 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.src::go-toolset:rhel8 +9
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.aarch64::go-toolset:rhel8 +18
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.src::go-toolset:rhel8 +9
  • RHSA-2025:21382 Released 2025-11-13 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-3.module+el8.8.0+22903+37387f31.ppc64le::go-toolset:rhel8 +12
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-3.module+el8.8.0+22903+37387f31.src::go-toolset:rhel8 +9
  • RHSA-2025:21385 Released 2025-11-13 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-3.module+el8.4.0+22765+91da4d3f.src::go-toolset:rhel8 +9
  • RHSA-2025:21383 Released 2025-11-13 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) delve-1.3.2-3.module+el8.2.0+5581+896cb53e.src::go-toolset:rhel8, delve-1.3.2-3.module+el8.2.0+5581+896cb53e.x86_64::go-toolset:rhel8, go-toolset-1.13.15-1.module+el8.2.0+7662+fa98b974.src::go-toolset:rhel8 +9
  • RHSA-2025:21337 Released 2025-11-13 · Red Hat rating Moderate
    golang security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) golang-1.19.13-19.el9_2, golang-bin-1.19.13-19.el9_2, golang-docs-1.19.13-19.el9_2 +4
  • RHSA-2025:21336 Released 2025-11-13 · Red Hat rating Moderate
    golang security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) golang-1.17.13-7.el9_0, golang-bin-1.17.13-7.el9_0, golang-docs-1.17.13-7.el9_0 +4
  • RHSA-2025:21132 Released 2025-11-12 · Red Hat rating Moderate
    Release of containers for RHOSO 18.0.14
    • Red Hat OpenStack Services on OpenShift 18.0 registry.redhat.io/rhoso-operators/ovn-rhel9-operator
  • RHSA-2025:20983 Released 2025-11-11 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 10) podman-7:5.6.0-5.el10_1, podman-docker-7:5.6.0-5.el10_1, podman-remote-7:5.6.0-5.el10_1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests-7:5.6.0-5.el10_1
  • RHSA-2025:20909 Released 2025-11-11 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-6:5.6.0-6.el9_7, podman-docker-6:5.6.0-6.el9_7, podman-plugins-6:5.6.0-6.el9_7 +2
  • RHSA-2025:19961 Released 2025-11-10 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-volsync-addon-controller-rhel9 +6
  • RHSA-2025:19731 Released 2025-11-04 · Red Hat rating Moderate
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) podman-4:4.9.4-18.el9_4.4, podman-docker-4:4.9.4-18.el9_4.4, podman-plugins-4:4.9.4-18.el9_4.4 +2
  • RHSA-2025:19296 Released 2025-11-04 · Red Hat rating Moderate
    OpenShift Container Platform 4.20.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2025:19397 Released 2025-11-03 · Red Hat rating Moderate
    golang security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) go-toolset-1.21.13-11.el9_4, golang-1.21.13-11.el9_4, golang-bin-1.21.13-11.el9_4 +4
  • RHSA-2025:19381 Released 2025-10-30 · Red Hat rating Moderate
    Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.9.1
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/assisted-service-8-rhel8
  • RHSA-2025:19380 Released 2025-10-30 · Red Hat rating Moderate
    Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.9.1
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/assisted-service-9-rhel9
  • RHSA-2025:19335 Released 2025-10-30 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes 2.14.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +9
  • RHSA-2025:19332 Released 2025-10-30 · Red Hat rating Important
    multicluster engine for Kubernetes 2.9.1 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9 +7
  • RHSA-2025:17731 Released 2025-10-09 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.17.2 security update
    • Red Hat OpenShift GitOps 1.17 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel9 +4
  • RHSA-2025:17730 Released 2025-10-09 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.16.4 security update
    • Red Hat OpenShift GitOps 1.16 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel9 +3
  • RHSA-2025:13935 Released 2025-08-18 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.24.6-1.el9_6, golang-1.24.6-1.el9_6, golang-bin-1.24.6-1.el9_6 +5
  • RHSA-2025:13941 Released 2025-08-18 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.24.6-1.el10_0, golang-1.24.6-1.el10_0, golang-bin-1.24.6-1.el10_0 +5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Confidential Compute AttestationAffectedNo fix yet
Deployment Validation OperatorAffectedNo fix yet
Kube Descheduler OperatorAffectedNo fix planned: Will not fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Migration Toolkit for Applications 7AffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
NBDE Tang ServerAffectedNo fix planned: Will not fix
Network Observability OperatorAffectedNo fix yet
Node Maintenance OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix planned: Will not fix
OpenShift Run Once Duration Override OperatorAffectedNo fix yet
OpenShift Secondary Scheduler OperatorAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2AffectedNo fix yet
Power monitoring for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Certification for Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat Edge Manager previewAffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Cluster Manager CLIAffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift Dev Workspaces OperatorAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
Red Hat Openshift Sandboxed ContainersAffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix yet
Red Hat Runtimes Inventory OperatorAffectedNo fix yet
Red Hat Trusted Application PipelineAffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Web TerminalAffectedNo fix planned: Will not fix
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
external secrets operator for Red Hat OpenShift - Tech PreviewAffectedNo fix yet
mirror registry for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:5645
Cryostat 4 on RHEL 9Fixed RHSA-2025:21148
Multicluster Global Hub 1.6.6Fixed RHSA-2026:6226
OpenShift API for Data Protection 1.4Fixed RHSA-2026:2951
Red Hat Advanced Cluster Management for Kubernetes 2.12Fixed RHSA-2025:19961, RHSA-2025:22684, RHSA-2026:5633
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:0627, RHSA-2026:0718
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2025:19335, RHSA-2026:2351, RHSA-2026:2572, RHSA-2026:36882, RHSA-2026:67539
Red Hat Advanced Cluster Security 4.7Fixed RHSA-2025:23248
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2025:22179
Red Hat Ceph Storage 8Fixed RHSA-2026:2737
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:13941, RHSA-2025:20983
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:13935, RHSA-2025:20909
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:21383
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:21385
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:21384
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:21384
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:21382
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:21336
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:21337
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:19397, RHSA-2025:19731
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:21384
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:21382
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:20983
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:56347
Red Hat OpenShift AI 2.22Fixed RHSA-2025:22759
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:5107
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:4423
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:4482
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:4510
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:3905
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:4434
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2025:19296
Red Hat OpenShift GitOps 1.16Fixed RHSA-2025:17730
Red Hat OpenShift GitOps 1.17Fixed RHSA-2025:17731
Red Hat OpenStack Services on OpenShift 18.0Fixed RHSA-2025:21132
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:2155
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2025:23916, RHSA-2026:41941
Red Hat Quay 3.15Fixed RHSA-2026:1942
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:59431, RHSA-2026:59433, RHSA-2026:59439, RHSA-2026:59451
Red Hat Web Terminal 1.11Fixed RHSA-2026:94072
Red Hat Web Terminal 1.13Fixed RHSA-2026:94070
Red Hat Web Terminal 1.14Fixed RHSA-2026:94074
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:1071
multicluster engine for Kubernetes 2.7Fixed RHSA-2026:5636
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:0722, RHSA-2026:8218
multicluster engine for Kubernetes 2.9Fixed RHSA-2025:19332, RHSA-2025:19380, RHSA-2025:19381, RHSA-2026:2571
Not affected: 57 products
  • Builds for Red Hat OpenShift
  • Fence Agents Remediation Operator
  • File Integrity Operator
  • Gatekeeper 3
  • Logging Subsystem for Red Hat OpenShift
  • Logical Volume Manager Storage
  • Machine Deletion Remediation Operator
  • Multiarch Tuning Operator
  • Multicluster Global Hub 1.6.6
  • Node HealthCheck Operator
  • OpenShift API for Data Protection 1.4
  • OpenShift Serverless
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.12
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Security 4.7
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ceph Storage 8
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.22
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.16
  • Red Hat OpenShift GitOps 1.17
  • Red Hat OpenShift Update Service
  • Red Hat OpenShift for Windows Containers
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Services on OpenShift 18.0
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Quay 3.15
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Web Terminal 1.11
  • Red Hat Web Terminal 1.13
  • Red Hat Web Terminal 1.14
  • Red Hat build of Apache Camel - HawtIO 4
  • Self Node Remediation Operator
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.7
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47907
  2. 2026-10-03 Alias added: GHSA-j5pm-7495-qmr3
  3. 2026-10-06 Affected versions changed · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
  6. 2026-10-27 Affected versions changed · Red Hat
  7. 2026-11-03 Fix available: RHSA-2026:94074 · Red Hat
  8. 2026-11-03 Fix available: RHSA-2026:94072 · Red Hat
  9. 2026-11-03 Fix available: RHSA-2026:94070 · Red Hat
  10. 2026-11-03 Fix available: Red Hat Web Terminal 1.11, Red Hat Web Terminal 1.13, Red Hat Web Terminal 1.14 · Red Hat

References

Patch 1

Advisory 2

Other 1

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences