This advisory addresses two security vulnerabilities in Red Hat multicluster global hub prior to version 1.2.2. The first vulnerability (CVE-2025-22869) is a denial of service issue in the key exchange mechanism of the golang.org/x/crypto/ssh package. The second vulnerability (CVE-2025-22868) involves unexpected memory consumption during token parsing in the golang.org/x/oauth2/jws package. Both vulnerabilities stem from third-party Go libraries used within the product. Red Hat has released updated container images in version 1.2.2 that include fixes for these issues.

Successful exploitation of CVE-2025-22869 could cause denial of service in the SSH key exchange process, potentially disrupting service availability. CVE-2025-22868 could lead to unexpected memory consumption during token parsing, which may degrade system performance or cause resource exhaustion. Red Hat rates the overall security impact of these fixes as Important, indicating a high but not critical severity level.

Red Hat has released version 1.2.2 of the multicluster global hub container images which include fixes for these vulnerabilities. Users should update to version 1.2.2 or later to remediate these issues. Prior to applying this update, ensure all previously released errata have been applied. No additional mitigation steps are indicated by the vendor advisory.