This advisory covers Red Hat OpenShift Container Platform 4.18.31, which fixes several security vulnerabilities: CVE-2025-8677 (bind resource exhaustion via malformed DNSKEY handling), CVE-2025-40778 and CVE-2025-40780 (bind cache poisoning attacks due to unsolicited RRs and weak PRNG), CVE-2025-59375 (libexpat large dynamic memory allocations triggered by small documents), CVE-2025-9230 (openssl out-of-bounds read and write in RFC 3211 KEK Unwrap), and CVE-2025-11234 (qemu-kvm VNC WebSocket handshake use-after-free). The update addresses these issues by providing patched container images and RPM packages. Users of OpenShift Container Platform 4.18 prior to 4.18.31 are affected and should upgrade to the fixed version. The vendor advisory rates the update as having an important security impact and provides detailed upgrade instructions.

The vulnerabilities fixed in this update could allow attackers to cause resource exhaustion, perform cache poisoning attacks, trigger large memory allocations, and exploit out-of-bounds memory access and use-after-free bugs. These issues could lead to denial of service or potentially other impacts depending on the component exploited. The advisory rates the security impact as important, indicating a high severity level but does not provide explicit CVSS scores. No known exploits in the wild have been reported at this time.

A fix is available in Red Hat OpenShift Container Platform version 4.18.31. All users running versions >=4.18.0 and <4.18.31 are advised to upgrade to 4.18.31 as soon as it is available in their release channel. Upgrades can be performed using the OpenShift CLI (oc) or the web console. Detailed upgrade instructions are provided by Red Hat at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli. No additional mitigations are specified beyond applying the official update.