A vulnerability (CVE-2025-61726) was identified in the Go standard library net/url package used by Red Hat OpenShift Container Platform. The package does not limit the number of unique query parameters parsed, so an attacker can craft an HTTP request with a massive number of parameters. When processed by the net/http.Request.ParseForm method, this causes excessive memory allocation, leading to denial of service via application crash or unresponsiveness. Red Hat OpenShift Container Platform versions >=4.12.0 and <4.12.88 are affected. The issue has been fixed in version 4.12.88 with updated container images and RPM packages. Red Hat rates the security impact as low but the CVSS base score is 7.5 (important severity) due to the denial of service impact. No known exploits in the wild have been reported.

An attacker able to send specially crafted HTTP requests with a large number of unique query parameters can cause the affected OpenShift Container Platform application to consume excessive memory, resulting in denial of service by crashing or becoming unresponsive. There is no impact on confidentiality or integrity. The vulnerability affects availability only.

Red Hat has released OpenShift Container Platform 4.12.88 containing fixes for this vulnerability. Users should upgrade to version 4.12.88 or later as soon as possible using the official update channels (OpenShift CLI or web console). No practical mitigation other than upgrading has been identified. Follow Red Hat's documented upgrade instructions to fully apply the update. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without upgrade.