This advisory covers two denial of service vulnerabilities affecting the podman tool in Red Hat Enterprise Linux 9. The first, CVE-2025-22869, is a denial of service in the key exchange mechanism of golang.org/x/crypto/ssh. The second, CVE-2025-27144, is a denial of service vulnerability in the parsing functionality of the Go JOSE library. Podman is part of the libpod library used for managing container pods, a Kubernetes concept. The vulnerabilities could cause podman or related container operations to be disrupted by denial of service attacks. Red Hat has released updated packages for affected versions to address these issues.

Successful exploitation of these vulnerabilities could result in denial of service conditions affecting podman operations, potentially disrupting container management and orchestration on affected Red Hat Enterprise Linux 9 systems. There is no indication of privilege escalation or remote code execution. No known exploits in the wild have been reported.

Red Hat has released updated podman packages for Red Hat Enterprise Linux 9 versions prior to 9.7 and 9.8 that address these denial of service vulnerabilities. Users should apply the official security update as described in the Red Hat advisory RHSA-2025:7391. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation is indicated or required beyond applying the vendor-provided patches.