CVE-2025-14874: Improper Check or Handling of Exceptional Conditions in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
CVE-2025-14874 is a medium severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2 caused by improper handling of exceptional conditions in Nodemailer's address parser. A crafted email address header can trigger infinite recursion, leading to a denial of service (DoS). No affected versions or patch information are explicitly provided. The vulnerability does not impact confidentiality or integrity but affects availability.
AI Analysis
Technical Summary
This vulnerability arises from a flaw in Nodemailer used within Red Hat Advanced Cluster Management for Kubernetes 2. Specifically, the address parser in Nodemailer improperly handles certain crafted email address headers, causing infinite recursion. This results in a denial of service condition. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and impact limited to availability loss. No vendor advisory details on patch availability or mitigation steps are provided in the input data.
Potential Impact
The vulnerability allows an unauthenticated attacker to cause a denial of service by sending a specially crafted email address header that triggers infinite recursion in the address parser. This impacts system availability but does not affect confidentiality or integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-14874 for current remediation guidance. No specific mitigation or workaround information is provided in the vendor advisory content supplied.
CVE-2025-14874: Improper Check or Handling of Exceptional Conditions in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Description
CVE-2025-14874 is a medium severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2 caused by improper handling of exceptional conditions in Nodemailer's address parser. A crafted email address header can trigger infinite recursion, leading to a denial of service (DoS). No affected versions or patch information are explicitly provided. The vulnerability does not impact confidentiality or integrity but affects availability.
CVSS v3.1
Score 5.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from a flaw in Nodemailer used within Red Hat Advanced Cluster Management for Kubernetes 2. Specifically, the address parser in Nodemailer improperly handles certain crafted email address headers, causing infinite recursion. This results in a denial of service condition. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and impact limited to availability loss. No vendor advisory details on patch availability or mitigation steps are provided in the input data.
Potential Impact
The vulnerability allows an unauthenticated attacker to cause a denial of service by sending a specially crafted email address header that triggers infinite recursion in the address parser. This impacts system availability but does not affect confidentiality or integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-14874 for current remediation guidance. No specific mitigation or workaround information is provided in the vendor advisory content supplied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2025-12-18T06:54:04.556Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6943c1bb4eb3efac3675c967
Added to database: 12/18/2025, 08:56:27 UTC
Last enriched: 07/16/2026, 10:56:49 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 323
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.