This advisory addresses two security vulnerabilities in Red Hat OpenShift Container Platform 4.13. The first, CVE-2025-30204, is a flaw in the golang-jwt/jwt library where specially crafted Authorization headers can trigger excessive memory allocation during JWT header parsing, leading to significant resource consumption and potential denial of service. The second, CVE-2025-53547, affects Helm v3 and allows code execution via crafted Helm charts. Red Hat has released OpenShift Container Platform 4.13.61 with updated packages and container images to fix these vulnerabilities. The advisory includes detailed upgrade instructions and references to CVE pages for further information.

The golang-jwt/jwt vulnerability can cause significant performance degradation or application crashes due to excessive memory allocation, resulting in denial of service. The Helm vulnerability allows for code execution, which could lead to compromise of the affected system. Red Hat rates the overall security impact of the update as Low, but the golang-jwt/jwt issue specifically has a CVSS v3 base score of 7.5 (High) for availability impact. There are no known exploits in the wild at this time.

Red Hat has released OpenShift Container Platform 4.13.61 which includes fixes for these vulnerabilities. Users should upgrade to version 4.13.61 or later using the OpenShift CLI or web console as soon as the update is available in their release channel. No alternative mitigations are currently recommended by Red Hat. Follow the official upgrade documentation to fully apply the errata update.