This advisory addresses security vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes versions 2.13 up to but not including 2.13.5. Among the issues fixed is CVE-2025-47907, a race condition in database/sql that can cause inconsistent query results when queries are cancelled during scanning, potentially leading to data inconsistency. Other issues include race conditions, improper synchronization, and resource management flaws (CWE-276, CWE-20, CWE-362, CWE-770, CWE-330, CWE-94). The vulnerabilities primarily affect concurrent query handling and cluster management components, which could cause unexpected behavior, crashes, or denial of service. The vendor advisory confirms fixes are included in version 2.13.5 and recommends applying this update.

The vulnerabilities can lead to inconsistent data being returned by the application, denial of service through resource exhaustion or crashes, and unexpected behavior due to race conditions and improper synchronization. The impact is primarily on data integrity and availability, with confidentiality impact possible if race conditions allow unauthorized data access. However, exploitation scope is limited and unlikely to result in direct system compromise in typical deployments. No known active exploits have been reported.

A fixed version, 2.13.5, is available and should be applied to remediate these vulnerabilities. The vendor advisory recommends ensuring all previously released errata are applied before updating. No alternative mitigations or workarounds are specified. Users should follow Red Hat's official update procedures as documented in their advisory and release notes.