This advisory covers security fixes in Red Hat multicluster global hub 1.3.3 container images. It addresses two vulnerabilities: CVE-2025-22868, which causes unexpected memory consumption during token parsing in the golang.org/x/oauth2 library, and CVE-2025-22869, a denial of service vulnerability in the key exchange process of the golang.org/x/crypto/ssh library. These vulnerabilities relate to resource exhaustion and denial of service conditions. Red Hat has released updated container images that incorporate patches for these issues. Users of multicluster global hub 1.3 for RHEL 9 are advised to update to these fixed images. The advisory does not provide a CVSS score but classifies the update as having an important security impact.

The vulnerabilities could lead to unexpected memory consumption and denial of service conditions in components using the affected Golang libraries within Red Hat multicluster global hub. This may impact availability or stability of the affected services. There are no reports of active exploitation in the wild. The severity is rated as high by the source data, indicating significant potential impact if exploited.

Red Hat has released updated container images for multicluster global hub 1.3.3 that fix these vulnerabilities. Users should apply this update after confirming all prior relevant errata are installed. The vendor advisory does not indicate any additional mitigation or that no action is required. Patch status is confirmed by the availability of updated container images. Refer to the official Red Hat advisory RHSA-2025:3863 and product documentation for update instructions.