CVE-2025-47907 is a race condition vulnerability in the database/sql package affecting Red Hat OpenShift Container Platform versions 4.18 up to but not including 4.18.35. The flaw occurs when concurrent queries are cancelled during a Scan method call on returned Rows, potentially causing inconsistent data to be returned to the application. This race condition (CWE-362) can lead to unexpected behavior but is limited in scope and unlikely to cause direct compromise in typical deployments. Red Hat has rated this vulnerability as having an Important security impact and has released fixes in OpenShift Container Platform 4.18.35, including updated container images and RPM packages. Users are advised to upgrade to this version to mitigate the issue.

The vulnerability can cause inconsistent or unexpected query results in applications using the affected database/sql package when queries are cancelled concurrently during scanning. This may lead to data integrity issues or application instability but does not typically result in direct system compromise. The exploitation scope is limited to applications that cancel queries while running multiple queries concurrently. There are no known exploits in the wild. The overall security impact is rated as Important by Red Hat.

Red Hat has released OpenShift Container Platform 4.18.35, which includes fixes for this vulnerability. Users should upgrade to version 4.18.35 or later to fully mitigate the issue. Instructions for upgrading clusters are available in the official Red Hat OpenShift documentation. No additional mitigations are specified or required beyond applying the official update.