CVE-2025-47907 describes a race condition in the database/sql package used by Red Hat OpenShift Container Platform. When a query is cancelled during a Scan method call on returned Rows, concurrent queries can produce inconsistent or unexpected results. This race condition (CWE-362) can lead to data inconsistency in applications that initiate and cancel queries concurrently. The vulnerability is rated as important by Red Hat and affects OpenShift Container Platform versions from 4.17.0 up to but not including 4.17.51. The update to 4.17.51 includes fixes for this and other issues. The vulnerability does not have known exploits in the wild and requires specific application behavior to be exploitable.

This vulnerability can cause applications using the affected database/sql package to receive inconsistent or unexpected data when queries are cancelled during scanning of results. The impact is primarily on data integrity and consistency rather than direct system compromise. There are no known active exploits in the wild. The vulnerability requires an attacker to be able to initiate and cancel queries concurrently, which limits the scope of exploitation. Red Hat classifies the security impact as important but notes the exploitation scope is limited and unlikely to lead to direct compromise in typical deployments.

Red Hat has released OpenShift Container Platform version 4.17.51 which includes the fix for this race condition vulnerability. Users should upgrade to version 4.17.51 or later to remediate this issue. Instructions for upgrading are available in the official Red Hat OpenShift documentation. No additional mitigations are specified or required beyond applying the official update.