The vulnerability CVE-2025-47914 affects the golang.org/x/crypto/ssh/agent library used in SSH Agent servers within the multicluster engine for Kubernetes v2.8 images. The flaw arises because the server does not properly validate the size of incoming messages during new identity requests. A specially crafted malformed message can cause an out-of-bounds read, resulting in a panic and termination of the program, effectively causing a denial of service. Red Hat rates this vulnerability as moderate severity for their products. The advisory does not explicitly mention a patch or fixed version but references updated images and documentation for installation. The vulnerability is associated with CWE-125 (Out-of-bounds Read) and related weaknesses.

The vulnerability allows a remote attacker to cause a denial of service by crashing the SSH Agent server component through malformed messages. This results in program termination and potential disruption of the multicluster engine's management capabilities. There is no indication of confidentiality or integrity impact beyond availability. No known exploits in the wild have been reported. The impact is limited to availability degradation due to crashes.

The vendor advisory does not explicitly confirm a patch or fixed version for this vulnerability. Users should consult the official Red Hat documentation and advisories for updated images and installation instructions. Since this is a denial of service vulnerability caused by malformed messages, applying updated container images or engine versions when available is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.