This advisory covers security fixes in Red Hat OpenShift Container Platform 4.14.59, including multiple container escape vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) caused by mount race conditions, malicious configuration involving /dev/console mounts, and arbitrary write gadgets with procfs write redirects. Additionally, it fixes a request smuggling vulnerability in the net/http package (CVE-2025-22871) due to acceptance of invalid chunked data. These vulnerabilities could allow attackers to escape container isolation or cause denial of service. The advisory provides updated RPM packages and container images to address these issues.

The vulnerabilities fixed in this update could allow attackers to escape container isolation, potentially gaining unauthorized access to the host system or other containers, and cause denial of service. The request smuggling vulnerability in net/http could allow manipulation of HTTP requests, potentially impacting application behavior. Red Hat rates the overall security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated RPM packages and container images in OpenShift Container Platform 4.14.59 that fix these vulnerabilities. Users should upgrade their OpenShift clusters to version 4.14.59 using the OpenShift CLI or web console following Red Hat's official upgrade documentation. Applying these updates fully mitigates the described security issues. No additional mitigations are specified by the vendor.