The vulnerability CVE-2025-47907 involves a race condition in the database/sql package where concurrent queries can produce unexpected results if a query is cancelled during a Scan method call on returned Rows. This creates a race condition that may lead to inconsistent data being returned to the application. The flaw requires an attacker to be able to initiate and cancel queries concurrently. Red Hat Multicluster Global Hub versions >=1.6.0 and <1.6.2 are affected. Red Hat has issued a security update in version 1.6.2 to fix this issue. The vulnerability is rated as moderate by Red Hat, with a CVSS base score of 7.0 (high severity) by NVD, but Red Hat classifies the impact as important due to limited exploitation scope and typical deployment scenarios.

The vulnerability can cause inconsistent data to be returned by the database/sql package when queries are cancelled concurrently during scanning. This may lead to unexpected application behavior but is unlikely to result in direct compromise or privilege escalation in typical deployments. The issue primarily impacts data integrity and availability, with potential for denial of service or resource exhaustion in some cases. There are no known exploits in the wild. The impact is limited to applications that perform concurrent query cancellations.

A fixed version of Red Hat Multicluster Global Hub is available: version 1.6.2. Users should upgrade to this version to resolve the vulnerability. No additional mitigations are specified by Red Hat. Since this is a software defect fixed in the updated release, applying the official update is the recommended remediation.