This advisory addresses two security vulnerabilities in Red Hat OpenShift Data Foundation versions 4.18.0 up to but not including 4.18.3. CVE-2025-22868 involves unexpected memory consumption during token parsing in the golang.org/x/oauth2/jws package. CVE-2025-22870 concerns an HTTP proxy bypass vulnerability using IPv6 Zone IDs in the golang.org/x/net/http/httpproxy package. The update also includes other bug fixes and upgrades, such as an upgrade to the Ceph version RHCEPH-8.0z3. The vulnerabilities are fixed in version 4.18.3, which is available for multiple architectures including x86_64, ppc64le, s390x, and aarch64 on RHEL 9. The vendor advisory recommends applying this update after ensuring all previous errata are applied.

The vulnerabilities could lead to unexpected memory consumption and HTTP proxy bypass, potentially affecting the security and stability of the Red Hat OpenShift Data Foundation storage platform. These issues may impact the handling of OAuth2 tokens and network proxy configurations, which could be exploited to bypass security controls or cause denial of service conditions. However, no known exploits in the wild have been reported at this time.

A fix is available in Red Hat OpenShift Data Foundation version 4.18.3. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. The update is distributed via Red Hat Container Registry. Follow the vendor's official guidance for applying the update: https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.