CVE-2025-22869 is a denial of service vulnerability in the golang.org/x/crypto/ssh package used by Red Hat OpenShift Builds versions >=1.2 and <1.4. The flaw allows an attacker to cause increased resource consumption, including memory exhaustion, during SSH key exchange when the other party is slow to respond. This can lead to denial of service conditions. While both SSH clients and servers using this package are affected, practical exploitation is limited mainly to scenarios involving large file transfers. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-405. Red Hat has not yet released a fix but recommends mitigation by restricting clients to trusted servers.

The vulnerability can cause denial of service through resource exhaustion (memory and CPU) during SSH key exchange, potentially disrupting OpenShift Builds operations. There is no impact on confidentiality or integrity. Exploitation requires network access and can occur without user interaction or privileges. The likelihood of exploitation is reduced due to the requirement of large file transfers and slow responses during key exchange. No known exploits are currently in the wild.

No official fix is currently available for this vulnerability in Red Hat OpenShift Builds 1.2 to before 1.4. Red Hat recommends mitigating the risk by configuring SSH clients to connect only to trusted servers. Monitor Red Hat advisories for updates on patches or official fixes. Avoid connecting to untrusted or potentially malicious SSH servers to reduce exposure.