CVE-2025-61726 is a denial of service vulnerability in the Go net/url package where no limit is enforced on the number of unique query parameters parsed. Applications using net/http.Request.ParseForm will attempt to process all parameters, and a crafted HTTP request with many unique query parameters can cause excessive memory consumption, leading to application crash or unresponsiveness. This vulnerability affects Red Hat Multicluster Global Hub versions >=1.4.4 <1.4.5. Red Hat has released version 1.4.5 containing security fixes that mitigate this issue. The vulnerability is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling).

An attacker able to send HTTP requests to a vulnerable Red Hat Multicluster Global Hub instance can cause a denial of service by exhausting memory resources through a large number of unique query parameters. There is no impact on confidentiality or integrity. The application may crash or become unresponsive, disrupting availability.

Red Hat has released Multicluster Global Hub version 1.4.5 which includes a security update addressing this vulnerability. Users should update affected installations to version 1.4.5 as soon as possible. No practical mitigation other than updating is currently identified.