The Red Hat Migration Toolkit for Containers (MTC) version 1.8.7 includes security fixes for several vulnerabilities: CVE-2024-21536 (denial of service in http-proxy-middleware), CVE-2024-21538 (regular expression denial of service in cross-spawn), CVE-2024-45338 (non-linear parsing in golang.org/x/net/html), CVE-2025-22868 (unexpected memory consumption in golang.org/x/oauth2/jws), and CVE-2025-30204 (excessive memory allocation in golang-jwt/jwt). These issues could cause denial of service or excessive memory use during parsing operations. The update addresses these by patching the affected dependencies and MTC components. The advisory references multiple bugzilla entries and provides detailed remediation instructions. The update is rated Important by Red Hat Product Security.

The vulnerabilities fixed in this update can lead to denial of service conditions or excessive memory consumption when parsing certain inputs in MTC and its dependencies. This could disrupt migration operations between OpenShift clusters or degrade service availability. No known exploits in the wild have been reported. The impact is primarily on resource exhaustion and service stability.

A security update to Migration Toolkit for Containers version 1.8.7 is available and should be applied. Before applying this update, ensure all previously released errata relevant to your system have been installed. Follow Red Hat's official guidance at https://access.redhat.com/articles/11258 for applying updates. No additional mitigations are specified beyond applying the official patch.