Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

The vulnerability identified as CVE-2025-47911 affects the html.Parse function in the golang.org/x/net/html package, which is used by Red Hat OpenShift API for Data Protection (OADP). The function exhibits quadratic parsing complexity on certain crafted inputs, enabling an attacker to cause uncontrolled resource consumption (CPU, memory) leading to denial of service. This can result in application slowdown, crashes, or unavailability when processing untrusted HTML content. Red Hat has released a security advisory (RHSA-2026:43692) with an updated OADP version that includes fixes for this and other issues. The vulnerability is associated with CWE-400 (Uncontrolled Resource Consumption).

Exploitation of this vulnerability can cause denial of service by exhausting system resources due to inefficient parsing of malicious HTML input. This may lead to application crashes or unresponsiveness, affecting availability of backup and restore functionality in OpenShift API for Data Protection. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been reported.

Red Hat has released an updated version of OpenShift API for Data Protection that addresses this vulnerability. Users should apply the update as per the Red Hat advisory RHSA-2026:43692 after ensuring all previous relevant errata are applied. No additional mitigations are specified by the vendor. Patch status is confirmed as fixed in the updated OADP release.