This advisory covers security improvements in Red Hat OpenShift distributed tracing platform (Jaeger) 3.5.2, which fixes vulnerabilities including CVE-2025-7425, CVE-2025-8058, and CVE-2025-32415. CVE-2025-32415 is a heap-based underflow in the libxml2 library that can be triggered by processing specially crafted XML documents or schemas with certain identity constraints, leading to application crashes and denial of service. Exploitation requires the ability to process crafted XML files with applications linked to libxml2. The vulnerability impacts availability but does not affect confidentiality or integrity. The advisory does not report any breaking changes, deprecations, or new features in this release.

The primary impact of the vulnerabilities fixed in this release is denial of service due to application crashes caused by heap-based underflow in libxml2 when processing crafted XML content. There is no reported confidentiality or integrity impact. No known exploits are reported in the wild. The vulnerabilities affect availability of the affected software versions.

A fixed version, Red Hat OpenShift distributed tracing platform (Jaeger) 3.5.2, is available and should be applied to remediate these vulnerabilities. Users should upgrade from versions >=3.5.0 and <3.5.2 to 3.5.2. Additionally, to mitigate CVE-2025-32415, avoid processing untrusted XML files with applications linked to the libxml2 library. Follow Red Hat's official upgrade instructions for applying this update.