The vulnerability (CVE-2025-58058) involves a memory leak in the golang github.com/ulikunitz/xz package integrated into the multicluster engine for Kubernetes 2.8.8, which is part of the Assisted Installer RHEL 9 components. The issue arises because the LZMA header lacks a magic number or checksum to detect prepended data, leading the decoder to allocate a full decoding buffer prematurely. Although the code later detects the anomaly, the memory allocation has already occurred, resulting in increased memory consumption. This can cause denial of service through resource exhaustion. Red Hat has not provided a patch or mitigation that meets their criteria for ease of use, applicability, or stability. The advisory references CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-426. No known exploits are reported in the wild.

The vulnerability can lead to increased memory consumption and potential denial of service due to resource exhaustion when processing crafted LZMA-encoded byte streams. This impacts the stability and availability of systems running the affected multicluster engine for Kubernetes components. There is no indication of confidentiality or integrity impact.

Red Hat has not released a patch or official mitigation for this vulnerability as current options do not meet their criteria for deployment and stability. Users should monitor Red Hat advisories for future updates. No immediate workaround is provided by the vendor.