CVE-2025-61726 is a denial of service vulnerability in the Go standard library's net/url package, which is used by Red Hat OpenShift Container Platform. The flaw arises because the package does not enforce limits on the number of unique query parameters parsed by the net/http.Request.ParseForm method. An attacker can exploit this by sending an HTTP request with a large number of unique query parameters, causing excessive memory allocation and consumption, leading to application crashes or unresponsiveness. This vulnerability impacts OpenShift Container Platform versions >=4.20.0 and <4.20.23. Red Hat has released version 4.20.23 containing updated container images and RPM packages that fix this issue. The vulnerability is rated with an important severity by Red Hat and has a CVSS v3 base score of 7.5 (high) according to Red Hat's assessment. No known exploits in the wild have been reported. The vendor advisory recommends upgrading to the fixed version as the primary mitigation.

The vulnerability allows an unauthenticated attacker to cause a denial of service by sending a specially crafted HTTP request with a large number of unique query parameters. This leads to excessive memory consumption by the affected application, potentially causing it to crash or become unresponsive. There is no impact on confidentiality or integrity. The impact is limited to availability degradation.

Red Hat has released OpenShift Container Platform 4.20.23 with updated container images and RPM packages that fix this vulnerability. Users should upgrade to version 4.20.23 or later as soon as possible to mitigate the risk. No practical workaround or mitigation other than upgrading has been identified by Red Hat. Instructions for upgrading are available in the official Red Hat OpenShift documentation. Since this is not a cloud service, remediation is the responsibility of the user.