CVE-2025-22869 is a resource exhaustion vulnerability in the golang.org/x/crypto/ssh package used by Red Hat OpenShift for Windows Containers 10.19.0. The flaw occurs during SSH key exchange when the other party is slow to respond, leading to excessive memory consumption and a potential denial of service. Both SSH clients and servers using this package are affected, but practical exploitation is limited to scenarios involving large file transfers. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat's advisory notes the issue and provides mitigation guidance but does not confirm an available patch.

The vulnerability can cause denial of service through resource exhaustion (memory) on systems running affected versions of Red Hat OpenShift for Windows Containers. This may disrupt SSH connectivity and related container workloads. There is no impact on confidentiality or integrity reported. Exploitation likelihood is reduced due to the requirement for slow key exchange responses and large file transfers.

Red Hat advises mitigating this vulnerability by using the SSH client only to connect to trusted servers. No official patch or update is currently confirmed for this vulnerability in the advisory. Users should monitor Red Hat advisories for future fixes and follow documented upgrade procedures for the Windows Machine Config Operator as referenced. No additional immediate actions are specified by the vendor.