CVE-2025-47907 is a race condition vulnerability in the database/sql package used by Red Hat OpenShift Container Platform. When concurrent queries are executed and a query is cancelled during a Scan method call on returned Rows, a race condition can occur, causing inconsistent data to be returned. This vulnerability requires an attacker to be able to initiate and cancel queries concurrently. Red Hat rates this issue as moderate severity, noting that exploitation scope is limited and unlikely to lead to direct compromise in typical deployments. The update to OpenShift Container Platform 4.16.58 includes fixes for this and other bugs, with detailed upgrade instructions provided by Red Hat.

The vulnerability can lead to inconsistent or unexpected query results in applications using the affected database/sql package when queries are cancelled concurrently. This may cause application instability or incorrect data processing. However, the scope of exploitation is limited to scenarios where an attacker can initiate and cancel queries concurrently. There is no indication of direct privilege escalation or remote code execution. The overall security impact is moderate.

Red Hat has released OpenShift Container Platform 4.16.58 which includes fixes for this vulnerability. Users should upgrade to version 4.16.58 or later to apply the security update. Detailed upgrade instructions are available in the Red Hat OpenShift documentation. No alternative mitigations are specified by Red Hat. Since this is a moderate severity issue with limited exploitation scope, applying the official update is the recommended remediation.