CVE-2025-47907 is a race condition vulnerability in the database/sql package used by Red Hat OpenShift API for Data Protection. When a query is cancelled during a Scan method call on returned Rows, concurrent queries can produce unexpected and inconsistent results due to improper synchronization. This flaw could allow an attacker capable of initiating and cancelling queries to trigger inconsistent data returns. The vulnerability is related to CWE-362 (race condition), CWE-59, and CWE-1050, and impacts confidentiality, integrity, and availability to varying degrees. Red Hat has released a security advisory (RHSA-2026:2951) with a fix for this issue.

The vulnerability can cause inconsistent data to be returned to applications using the affected database/sql package when queries are cancelled concurrently. This may lead to data integrity issues and potential denial of service conditions due to resource exhaustion or crashes. However, the scope of exploitation is limited to applications that cancel queries while running multiple queries concurrently. There is no indication of direct compromise or privilege escalation in typical deployments.

Red Hat has released an updated version of OpenShift API for Data Protection that addresses this vulnerability. Users should apply the update as per Red Hat Security Advisory RHSA-2026:2951 after ensuring all previously released errata relevant to their system have been applied. No additional mitigations are specified or required beyond applying the official fix.