Red Hat Security Advisory: Red Hat build of Cryostat security update
An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) * qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
Two security vulnerabilities have been addressed in Red Hat products: CVE-2025-66566 involves information disclosure in the lz4-java library due to insufficient clearing of output buffers, and CVE-2025-15284 is a denial of service vulnerability in the qs component caused by improper input validation during array parsing. The fixes are included in updated packages and container images for Red Hat build of Cryostat 4 on RHEL 9 and Red Hat OpenShift Container Platform 4.20. The vendor advisory confirms the availability of these updates and provides guidance for applying them.
Potential Impact
The information disclosure vulnerability (CVE-2025-66566) could potentially expose sensitive data due to improper buffer clearing. The denial of service vulnerability (CVE-2025-15284) could allow an attacker to disrupt service by exploiting improper input validation in array parsing. Both vulnerabilities have been rated with a security impact of Important (high severity) by Red Hat Product Security. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released official security updates addressing these vulnerabilities. Users should apply the updates for Cryostat 4 on RHEL 9 and OpenShift Container Platform 4.20 as provided by Red Hat. Before applying these updates, ensure all previously released errata relevant to the system have been applied. Follow the vendor's documented procedures for updating packages and container images, including using the OpenShift CLI or web console for cluster upgrades. No additional mitigation actions are required beyond applying the official patches.
Red Hat Security Advisory: Red Hat build of Cryostat security update
Description
An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) * qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Two security vulnerabilities have been addressed in Red Hat products: CVE-2025-66566 involves information disclosure in the lz4-java library due to insufficient clearing of output buffers, and CVE-2025-15284 is a denial of service vulnerability in the qs component caused by improper input validation during array parsing. The fixes are included in updated packages and container images for Red Hat build of Cryostat 4 on RHEL 9 and Red Hat OpenShift Container Platform 4.20. The vendor advisory confirms the availability of these updates and provides guidance for applying them.
Potential Impact
The information disclosure vulnerability (CVE-2025-66566) could potentially expose sensitive data due to improper buffer clearing. The denial of service vulnerability (CVE-2025-15284) could allow an attacker to disrupt service by exploiting improper input validation in array parsing. Both vulnerabilities have been rated with a security impact of Important (high severity) by Red Hat Product Security. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released official security updates addressing these vulnerabilities. Users should apply the updates for Cryostat 4 on RHEL 9 and OpenShift Container Platform 4.20 as provided by Red Hat. Before applying these updates, ensure all previously released errata relevant to the system have been applied. Follow the vendor's documented procedures for updating packages and container images, including using the OpenShift CLI or web console for cluster upgrades. No additional mitigation actions are required beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:0761
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-66566"]
- State
- PUBLISHED
Threat ID: 6a160984e29bf47b50650c53
Added to database: 05/26/2026, 20:58:44 UTC
Last enriched: 08/15/2026, 00:17:28 UTC
Last updated: 09/10/2026, 22:05:25 UTC
Views: 173
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.