Loading story…
Red Hat issued Important security updates for VolSync, Gatekeeper, and Multicluster Global Hub to remediate CVE-2025-22869, a high-severity denial-of-service vulnerability in golang.org/x/crypto/ssh. A malicious SSH client can deliberately stall or never finish key exchange, causing affected servers that implement file-transfer protocols to retain pending content in memory. The flaw is fixed in golang.org/x/crypto version v0.35.0 and later.
The advisories also remediate CVE-2025-22868, which can trigger unexpected memory consumption while golang.org/x/oauth2/jws parses tokens. Affected organizations should apply the relevant Red Hat errata and updated container images across supported architectures; Red Hat also instructed customers to install prerequisite errata before deploying the Multicluster Global Hub update. OpenShift Container Platform 4.15.55 separately addressed CVE-2025-22868 through its normal release channels.
See affected versions and whether adversaries are exploiting it.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:7391 for Podman on RHEL 9, providing podman-5.4.0-9.el9_6 packages for x86_64, s390x, ppc64le, and aarch64. The update remediates CVE-2025-22869 in golang.org/x/crypto/ssh and CVE-2025-27144 in go-jose.
Red Hat issued RHSA-2025:7462 for Podman on RHEL 10, providing podman-5.4.0-9.el10_0 packages that remediate CVE-2025-22869 in golang.org/x/crypto/ssh and CVE-2025-27144 in go-jose. The update was supplied for x86_64, aarch64, ppc64le, and s390x systems.
Red Hat issued RHSA-2025:4502 for Advanced Cluster Management for Kubernetes 2.10.8 on RHEL 9, providing updated container images for aarch64, ppc64le, s390x, and x86_64. The update remediates CVE-2025-22869 in golang.org/x/crypto/ssh and CVE-2025-30204 in golang-jwt/jwt.
Red Hat issued RHSA-2025:4002 for Red Hat Advanced Cluster Management for Kubernetes 2.12.3 on RHEL 9. The updated container images remediate CVE-2025-22869 in golang.org/x/crypto/ssh and CVE-2025-22868 in golang.org/x/oauth2/jws.
Red Hat issued RHSA-2025:3959 for VolSync 0.11.2 container images used with Advanced Cluster Management for Kubernetes 2 on RHEL 9. The update remediates CVE-2025-22869 in golang.org/x/crypto/ssh and CVE-2025-22868 in golang.org/x/oauth2/jws, with updated images for aarch64, ppc64le, s390x, and x86_64.
Red Hat issued RHSA-2025:3932 for OpenShift Dev Spaces 3.20.0, updating x86_64 Dev Spaces containers and remediating CVE-2025-22869 in golang.org/x/crypto/ssh. The advisory also fixes CVE-2025-22868 in golang.org/x/oauth2/jws and CVE-2024-12905 in tar-fs.
Red Hat issued RHSA-2025:3863 for the Multicluster Global Hub 1.3.3 general-availability release, providing refreshed container images and fixes for CVE-2025-22869 in golang.org/x/crypto/ssh and CVE-2025-22868 in golang.org/x/oauth2/jws. Updated images were supplied for aarch64, ppc64le, s390x, and x86_64 architectures.
RHSA-2025:3498 released updated Red Hat Multicluster Global Hub 1.2.2 container images and remediated CVE-2025-22869 in golang.org/x/crypto/ssh, alongside CVE-2025-22868.
RHSA-2025:3172 released VolSync 0.12.1 container images for Red Hat Advanced Cluster Management for Kubernetes 2 on RHEL 9. The update fixes CVE-2025-22869 and CVE-2025-22868.
Red Hat issued RHSA-2025:3051 for Gatekeeper 3.17.2, remediating CVE-2025-22869 and CVE-2025-22868 and providing updated container images for multiple architectures.
Red Hat issued RHSA-2025:3053 for Gatekeeper 3.15.4, addressing CVE-2025-22869 in SSH key exchange as well as CVE-2025-22868 in golang.org/x/oauth2/jws.
Red Hat's Bugzilla record 2348367 for CVE-2025-22869 was reported. The high-severity flaw allows an SSH client to delay or abandon key exchange, causing affected file-transfer SSH servers to retain pending content in memory.
Red Hat released OpenShift Container Platform 4.15.51 as an Important security and bug-fix update for OpenShift 4.15. The update provides refreshed container images and remediates CVE-2025-22869 in golang.org/x/crypto/ssh across supported RHEL 8 and RHEL 9 architectures.
The denial-of-service vulnerability in golang.org/x/crypto/ssh was fixed in golang.org/x/crypto version 0.35.0 and later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
14 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released container-image and platform updates across its Kubernetes portfolio to remediate vulnerabilities in Go dependencies, chiefly **CVE-2024-45337** in `golang.org/x/crypto/ssh` and **CVE-2024-45338** in `golang.org/x/net/html`. The SSH issue can enable authorization bypass when applications misuse `ssh.ServerConfig.PublicKeyCallback`; the HTML flaw involves non-linear parsing of case-insensitive content. Affected products include OpenShift Container Platform 4.15 and 4.18, Advanced Cluster Management 2.9.6, Multicluster Global Hub 1.2 and 1.3, Gatekeeper 3.14 and 3.15, OpenShift Data Foundation 4.15, VolSync 0.10 and 0.11, and Advanced Cluster Security (RHACS) 4.4 and 4.5. Several releases also address **CVE-2024-53259**, a `quic-go` denial-of-service flaw in which forged ICMP Packet Too Large messages can disrupt established QUIC connections, and RHACS 4.6.2 fixes `go-git` argument injection (**CVE-2025-21613**) and malicious Git-server reply denial of service (**CVE-2025-21614**). Red Hat recommends upgrading affected platforms and container images through their supported release channels, including deployments on x86_64, aarch64, ppc64le, and s390x where applicable; RHACS customers should move to 4.4.8, 4.5.6, or 4.6.2 according to their release stream.
Aug 27, 2026
Red Hat released Important-severity updates for **Red Hat Service Interconnect** 1.4 and 1.5, RHEL 9.2 Go packages, and Red Hat OpenStack Platform 17.1 director Operator images to remediate multiple Go vulnerabilities. Key issues include `CVE-2023-45288`, where unlimited HTTP/2 CONTINUATION frames can exhaust resources; `CVE-2024-24783`, which can panic `crypto/x509` certificate verification when an unknown public-key algorithm is processed; and `CVE-2023-39326`, in which oversized HTTP chunk extensions can drive server memory consumption to roughly 1 GiB. The OpenStack update also fixes `CVE-2023-48795`, an SSH Binary Packet Protocol prefix-truncation flaw. Red Hat additionally updated OpenShift Container Platform 4.13 and 4.14 releases for `CVE-2024-1394`, a memory leak in `golang-fips/openssl` RSA encryption and decryption operations; OpenShift 4.14.19 also addresses `CVE-2024-28180`, involving improper handling of highly compressed data in `jose-go`. Affected organizations should update Service Interconnect images and `skupper-cli`, deploy the updated RHEL Go packages and OpenStack operator images, and upgrade OpenShift clusters through their supported release channels across x86_64, ARM64, IBM Power, and IBM Z/LinuxONE where applicable.
Aug 27, 2026
Red Hat released security updates across **OpenShift Container Platform**, OpenShift Data Foundation, OpenShift Serverless, distributed tracing, and the Red Hat build of Cryostat. The updates remediate vulnerabilities in shared Go, OpenSSH, networking, image-handling, and third-party libraries that could enable denial of service, resource exhaustion, memory leakage, sensitive-information exposure, or improper privilege propagation. Affected deployments span RHEL 8 and RHEL 9 and supported x86_64, ARM64, IBM Power, and IBM Z/LinuxONE architectures. Notable fixes include **CVE-2023-48795** (Terrapin), which permits an active attacker to truncate initial SSH secure-channel messages under vulnerable ChaCha20-Poly1305 or Encrypt-then-MAC configurations, and **CVE-2024-1394**, an RSA error-path memory leak in `golang-fips/openssl` that can cause resource exhaustion. OpenShift Container Platform updates also address a possible OpenSSH remote-code-execution condition on RHEL 9 associated with a signal-handling race. Red Hat advised customers to install relevant prior errata and upgrade clusters and operators through their supported release channels; temporary Terrapin mitigations include disabling `chacha20-poly1305` and EtM MAC algorithms where updates cannot be deployed immediately.
Aug 27, 2026