CVE-2025-61729 is a denial of service vulnerability in the golang crypto/x509 package affecting Red Hat OpenShift Data Foundation versions >=4.17.0 <4.17.24. The issue arises from unbounded string concatenation during the construction of error strings in the HostnameError.Error() function when handling a specially crafted certificate. This leads to excessive CPU and memory consumption, potentially causing the affected system to become unresponsive. The vulnerability is tracked under CWE-1050 (Excessive Platform Resource Consumption within a Loop) and has a Red Hat CVSS v3 base score of 7.5 (high severity). Red Hat has released a security update in version 4.17.24 to fix this issue.

Successful exploitation of this vulnerability can cause denial of service by consuming excessive system resources such as CPU and memory, resulting in degraded performance or system unavailability. There is no impact on confidentiality or integrity. The vulnerability requires no privileges or user interaction and can be triggered remotely via network by presenting a crafted certificate.

A fix is available in Red Hat OpenShift Data Foundation version 4.17.24. Users should apply this update to remediate the vulnerability. Before applying the update, ensure all previously released errata relevant to your system have been applied. No alternative mitigations are specified by the vendor advisory.