Gatekeeper versions >=3.15.0 and <3.15.4 are affected by two security issues in third-party Go libraries: CVE-2025-22868 involves unexpected memory consumption during token parsing in golang.org/x/oauth2, and CVE-2025-22869 is a denial of service vulnerability in the key exchange mechanism of golang.org/x/crypto/ssh. These issues could impact Gatekeeper's operation when processing OAuth2 tokens or SSH key exchanges. Red Hat released Gatekeeper v3.15.4 to remediate these vulnerabilities. The advisory notes that certain Kubernetes namespaces are exempt from admission control starting in v3.15, but this is unrelated to the security fixes. The vendor advisory is authoritative and provides upgrade instructions and references to release notes.

The vulnerabilities could lead to resource exhaustion (memory consumption) or denial of service conditions within Gatekeeper when processing OAuth2 tokens or SSH key exchanges. This may disrupt Gatekeeper's validating webhook functionality and policy enforcement in Kubernetes environments. No known exploits in the wild have been reported. The impact is rated as high severity by Red Hat due to potential service disruption.

Red Hat has released Gatekeeper version 3.15.4 which includes fixes for CVE-2025-22868 and CVE-2025-22869. Users should upgrade affected Gatekeeper installations from versions >=3.15.0 and <3.15.4 to version 3.15.4 or later. The vendor advisory does not indicate any temporary workarounds or that no action is required. Follow the official upgrade documentation and use supported Red Hat Advanced Cluster Management for Kubernetes subscriptions for support.