CVE-2025-59530VulnerabilityPublished 4 Dec 2025Updated 20 Oct 2026

Red Hat Security Advisory: Submariner v0.22 security fixes and container updates

Affects Red HatSource GCVE Database

Not known to be exploited.

Data as of 26 Oct 2026, 07:57 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected >=2.15 Red Hat Red Hat Ansible Automation Platform Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Advanced Cluster Management for Kubernetes Red Hat Advanced Cluster Management for Kubernetes 2.15 amd64 registry.redhat.io/rhacm2/lighthouse-agent-rhel9@sha256:fa636c3568f8e06bae8e929d0f2f5c0fe946ea9edd4a1450c9e4a40b9504f226_amd64	Fixed in–

AI-suggested

Red Hat currently does not offer a mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor the upstream Submariner and quic-go project release notes for future fixes. Upgrading to versions including fixes when available is recommended once released. No immediate action is required on Red Hat host systems as they are not affected.

Description

Submariner is a Kubernetes operator that enables cross-cluster connectivity for services and pods, implementing KEP-1645 (Multi-Cluster Services API). After deploying the Submariner operator, it can enable direct networking between pods and services across different Kubernetes clusters. For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.

Impact

The vulnerability can cause a denial of service by crashing the quic-go client process during the handshake phase when interacting with a malicious or misbehaving server. This impacts availability of applications using the quic-go library, including Submariner v0.22, but does not affect the underlying Red Hat host systems. There is no impact on confidentiality or integrity. No known exploits are reported in the wild beyond observed assertion failures.

Summary

CVE-2025-59530 is a denial of service vulnerability in the quic-go Golang library used by Submariner v0.22, which implements Kubernetes multi-cluster service connectivity. The flaw allows a malicious or misbehaving server to cause an assertion failure during the handshake phase, crashing the quic-go client process. This requires no authentication and has been observed in the wild with certain server implementations. The vulnerability is tracked as CWE-617 (Reachable Assertion). Red Hat's advisory clarifies that the availability risk is limited to applications embedding the quic-go library and that host Red Hat systems are not at risk. No effective mitigation currently meets Red Hat's criteria for deployment.

CWE-617Reachable Assertion (opens in a new tab)
Base weakness
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Implementation
Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
Implementation · Input Validation
Perform input validation on user data.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 20:59 UTC

WeaknessesCWE-617

Technical details

References

Community reviews

Related threats