This advisory covers multiple security vulnerabilities affecting Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP2 and associated Red Hat products such as OpenShift Container Platform 4.15 and Red Hat Enterprise Linux 10. Key vulnerabilities include CVE-2025-6021, an integer overflow in libxml2's xmlBuildQName() function leading to a stack buffer overflow; CVE-2025-7425, a heap use-after-free in libxslt; CVE-2025-48060, a stack buffer overflow in jq; and CVE-2025-48384 and CVE-2025-48385, arbitrary code execution and file write vulnerabilities in git. Additional issues include heap use-after-free and null pointer dereference in libxml2 causing denial of service. Red Hat has issued updated packages and container images to address these vulnerabilities. Users of affected products are advised to apply these updates promptly.

The vulnerabilities can result in denial of service conditions due to heap use-after-free and null pointer dereference bugs, as well as potential arbitrary code execution through git vulnerabilities. The integer overflow in libxml2 can cause stack buffer overflow, which may be exploitable. These issues affect core components used in Red Hat middleware and container platforms, potentially impacting system stability and security if exploited.

Red Hat has released official security updates and patches for all affected products, including Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP2, OpenShift Container Platform 4.15.57, and Red Hat Enterprise Linux 10 packages. Users should upgrade to the fixed versions as soon as they are available via the appropriate release channels. Instructions for upgrading OpenShift clusters are provided by Red Hat. No additional mitigations are indicated beyond applying these official updates.