The vulnerability CVE-2025-47913 affects Red Hat OpenShift Builds 1.6.0 and stems from a flaw in the golang.org/x/crypto/ssh/agent package. When the SSH agent client receives a generic SSH_AGENT_SUCCESS (0x06) message in response to requests expecting typed replies, the unmarshalling logic fails to handle this unexpected but protocol-legal message type properly. This results in a panic("unreachable") or nil-pointer dereference, causing the client process to crash. An attacker controlling or intercepting SSH agent traffic can exploit this to cause a reliable denial of service against processes relying on SSH agent interactions, particularly in environments using forwarded sockets or shared workspaces. The issue is a design-level reliability flaw rather than a simple error-handling bug. Red Hat classifies this as an important availability-impacting vulnerability with a CVSS v3 base score of 7.5 (high severity).

This vulnerability allows unauthenticated remote denial of service by causing the SSH agent client process to crash upon receiving a crafted SSH_AGENT_SUCCESS message. It affects availability by terminating critical automation or developer tooling processes that rely on SSH agent interactions. There is no impact on confidentiality or integrity. The flaw can be exploited by any malicious or misbehaving SSH agent or attacker intercepting SSH agent traffic.

Red Hat recommends upgrading from Red Hat OpenShift Builds version 1.6.0 to version 1.6.1, which addresses this vulnerability. Currently, no other mitigation meets Red Hat's standards for usability or stability. Users should apply the update as soon as possible to prevent denial of service.