The multicluster engine for Kubernetes 2.5.9 images include fixes for two vulnerabilities: CVE-2025-22868 in golang.org/x/oauth2/jws causing unexpected memory consumption during token parsing, and CVE-2025-30204 in golang-jwt/jwt allowing excessive memory allocation during JWT header parsing. These vulnerabilities could cause resource exhaustion due to excessive memory usage when processing tokens. The multicluster engine facilitates centralized management of multiple Kubernetes clusters across various environments. Red Hat has released updated container images to address these issues and recommends users install these updates following their documentation.

The vulnerabilities could lead to excessive memory consumption during token parsing operations within the multicluster engine for Kubernetes, potentially impacting system stability or availability due to resource exhaustion. No known exploits have been reported in the wild. The advisory classifies the security impact as Important, indicating a high severity but not critical. The issues specifically affect the token parsing components used in authentication or authorization workflows within the multicluster engine.

Red Hat has released updated container images for multicluster engine for Kubernetes version 2.5.9 that address these vulnerabilities. Users should follow Red Hat's official documentation to install the updated images to remediate the issues. Patch status is confirmed by the vendor advisory, and applying these updates is the recommended remediation. No additional mitigations or workarounds are specified in the advisory.