This advisory covers multiple security flaws affecting the Red Hat build of Cryostat 4 on RHEL 9 and associated Red Hat products. Key vulnerabilities include CVE-2025-48431, a denial of service in Apache Thrift c_glib caused by mismatched memory management routines triggered by specially crafted remote requests, leading to server crashes with 'free(): invalid pointer' errors. Additional vulnerabilities include cross-site scripting via DOMPurify, denial of service via inefficient certificate chain validation in crypto/x509, arbitrary code execution via command injection in shell-quote, security bypass in Apache Thrift due to improper certificate validation, and multiple high-impact issues in Netty such as HTTP request smuggling, header injection, and denial of service via unbounded memory allocation. Red Hat has issued security updates to address these issues. The vulnerabilities affect Red Hat Advanced Cluster Management for Kubernetes and other related products. The vendor advisory confirms the availability of fixes and provides detailed guidance for applying updates.

The vulnerabilities collectively can lead to denial of service conditions, arbitrary code execution, cross-site scripting, security bypass, and data confusion in affected Red Hat products. Specifically, CVE-2025-48431 allows unauthenticated remote attackers to crash Apache Thrift c_glib-based servers, causing service disruption. Other flaws may allow attackers to execute arbitrary commands, bypass security controls, or manipulate HTTP traffic, potentially impacting confidentiality, integrity, and availability of systems running the affected software.

Red Hat has released security updates addressing all listed vulnerabilities. Users should apply the provided updates for Red Hat build of Cryostat 4 on RHEL 9 and related products as detailed in the Red Hat advisory RHSA-2026:24539. Prior to applying updates, ensure all previously released relevant errata are installed. Follow Red Hat's official guidance for patching and updating to mitigate these vulnerabilities. No vendor advisory indicates that no action is required or that the issues are already mitigated without updates.