This advisory covers security fixes in Red Hat multicluster global hub 1.2.2 container images. It addresses two vulnerabilities: CVE-2025-22868, an unexpected memory consumption issue during token parsing in the golang.org/x/oauth2/jws package, and CVE-2025-22869, a denial of service vulnerability in the key exchange mechanism of golang.org/x/crypto/ssh. Both vulnerabilities stem from third-party Go libraries used within the product. Red Hat has released updated container images incorporating patches for these issues. The advisory does not provide a CVSS score but classifies the update as Important in severity.

The vulnerabilities could allow an attacker to cause denial of service conditions or excessive memory consumption in affected components of the multicluster global hub, potentially impacting availability and stability. No known exploits in the wild have been reported. The issues affect the golang.org/x/crypto/ssh and golang.org/x/oauth2/jws libraries used by the product. The overall security impact is rated as Important by Red Hat.

Red Hat has released updated container images for multicluster global hub version 1.2.2 that include fixes for these vulnerabilities. Users should apply this update after ensuring all previously released errata are applied. No additional mitigation steps are specified or required beyond applying the updated images provided by Red Hat.