CVE-2025-59530 is a denial of service vulnerability in the quic-go Golang library used by Submariner v0.22, which implements Kubernetes multi-cluster service connectivity. The flaw allows a malicious or misbehaving server to cause an assertion failure during the handshake phase, crashing the quic-go client process. This requires no authentication and has been observed in the wild with certain server implementations. The vulnerability is tracked as CWE-617 (Reachable Assertion). Red Hat's advisory clarifies that the availability risk is limited to applications embedding the quic-go library and that host Red Hat systems are not at risk. No effective mitigation currently meets Red Hat's criteria for deployment.

The vulnerability can cause a denial of service by crashing the quic-go client process during the handshake phase when interacting with a malicious or misbehaving server. This impacts availability of applications using the quic-go library, including Submariner v0.22, but does not affect the underlying Red Hat host systems. There is no impact on confidentiality or integrity. No known exploits are reported in the wild beyond observed assertion failures.

Red Hat currently does not offer a mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor the upstream Submariner and quic-go project release notes for future fixes. Upgrading to versions including fixes when available is recommended once released. No immediate action is required on Red Hat host systems as they are not affected.