This Red Hat security advisory addresses several vulnerabilities in RHACS 4.6 prior to 4.6.5. CVE-2024-21536 is a denial of service vulnerability caused by unhandled promise rejections in micromatch within http-proxy-middleware. CVE-2025-30204 involves excessive memory allocation during JWT header parsing in jwt-go, potentially leading to denial of service. CVE-2024-57083 is a prototype pollution vulnerability in redoc's mergeObjects function, allowing denial of service through crafted payloads. The advisory also fixes various bugs related to image scanning, compliance display, GKE compatibility, RBAC errors, and multi-signed image verification. Users are advised to upgrade to RHACS 4.6.5, which contains patches for these security issues.

Successful exploitation of these vulnerabilities could cause denial of service conditions in affected RHACS deployments. The flaws do not indicate remote code execution or data breach but could disrupt service availability by crashing or exhausting resources. The affected components include http-proxy-middleware, jwt-go, and redoc libraries used within RHACS. No known exploits in the wild have been reported at this time.

Red Hat has released an official patch in RHACS version 4.6.5 that addresses these vulnerabilities. Users running RHACS 4.6.0 through 4.6.4 are strongly advised to upgrade to version 4.6.5 to remediate these issues. No additional mitigation steps are indicated by the vendor advisory.