This advisory for Red Hat Advanced Cluster Management for Kubernetes 2.12.3 provides updated container images that fix two security vulnerabilities: CVE-2025-22868, an unexpected memory consumption during token parsing in golang.org/x/oauth2, and CVE-2025-22869, a denial of service vulnerability in the key exchange of golang.org/x/crypto/ssh. These fixes are part of a broader set of bug fixes and improvements in the 2.12.3 release. The affected versions are >=2.12.0 and <2.12.3. The vendor rates the security impact as Important. No CVSS scores are provided in the advisory. The update requires applying this new container image version after ensuring all previous errata are applied.

The vulnerabilities fixed include a memory consumption issue that could affect token parsing, potentially leading to resource exhaustion, and a denial of service vulnerability in the SSH key exchange process. These issues could impact the stability and availability of the affected Red Hat Advanced Cluster Management for Kubernetes deployments. The vendor rates the security impact as Important (high). There are no known exploits in the wild at the time of this advisory.

Apply the Red Hat Advanced Cluster Management for Kubernetes 2.12.3 container image updates to remediate the identified vulnerabilities. Before applying this update, ensure that all previously released errata relevant to your system have been applied. The vendor advisory provides updated container images that fix these issues. No additional mitigation steps are specified or required beyond applying the update.