Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.5 security update
An update is now available for Red Hat OpenShift GitOps. Bug Fix(es) and Enhancement(s): * GITOPS-8438 (CVE-2025-12816 openshift-gitops-1/console-plugin-rhel8: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications [gitops-1.17]) * GITOPS-8868 (CVE-2025-13465 openshift-gitops-1/console-plugin-rhel8: prototype pollution in _.unset and _.omit functions [gitops-1.17]) * GITOPS-8979 (CVE-2025-61726 openshift-gitops-1/argo-rollouts-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8980 (CVE-2025-61726 openshift-gitops-1/argocd-agent-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8981 (CVE-2025-61726 openshift-gitops-1/argocd-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8982 (CVE-2025-61726 openshift-gitops-1/argocd-rhel9: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8983 (CVE-2025-61726 openshift-gitops-1/dex-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8984 (CVE-2025-61726 openshift-gitops-1/gitops-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8985 (CVE-2025-61726 openshift-gitops-1/gitops-rhel8-operator: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8486 (CVE-2025-66418 openshift-gitops-1/console-plugin-rhel8: urllib3: Unbounded decompression chain leads to resource exhaustion [gitops-1.17]) * GITOPS-8487 (CVE-2025-66418 openshift-gitops-1/must-gather-rhel8: urllib3: Unbounded decompression chain leads to resource exhaustion [gitops-1.17]) * GITOPS-8641 (CVE-2025-66471 openshift-gitops-1/console-plugin-rhel8: urllib3 Streaming API improperly handles highly compressed data [gitops-1.17]) * GITOPS-8683 (CVE-2026-21441 openshift-gitops-1/console-plugin-rhel8: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) [gitops-1.17])
AI Analysis
Technical Summary
This security advisory covers multiple vulnerabilities in Red Hat OpenShift GitOps prior to version 1.17.5. The most notable is CVE-2025-12816, an interpretation conflict vulnerability in the node-forge library that allows unauthenticated attackers to bypass cryptographic verifications by crafting malicious ASN.1 structures, causing semantic divergence in schema validation. Other vulnerabilities include prototype pollution (CVE-2025-13465), memory exhaustion in query parameter parsing (CVE-2025-61726), and resource exhaustion via unbounded decompression chains (CVE-2025-66418 and CVE-2026-21441). These issues affect multiple components such as console-plugin, argocd, dex, and gitops operators. Red Hat has released version 1.17.5 of OpenShift GitOps containing fixes for these vulnerabilities.
Potential Impact
Exploitation of CVE-2025-12816 could allow unauthenticated attackers to bypass cryptographic verification and security decisions, potentially undermining the integrity and confidentiality of affected systems. Other vulnerabilities may lead to prototype pollution, memory exhaustion causing denial of service, and resource exhaustion through decompression bomb attacks. These impacts can degrade system reliability and security. No known active exploitation has been reported.
Mitigation Recommendations
An official security update is available in Red Hat OpenShift GitOps version 1.17.5 that addresses these vulnerabilities. It is recommended to apply this update after ensuring all prior relevant errata are applied. No effective mitigations meeting Red Hat's criteria are currently available other than upgrading. Users should follow Red Hat's published guidance for applying the update.
Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.5 security update
Description
An update is now available for Red Hat OpenShift GitOps. Bug Fix(es) and Enhancement(s): * GITOPS-8438 (CVE-2025-12816 openshift-gitops-1/console-plugin-rhel8: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications [gitops-1.17]) * GITOPS-8868 (CVE-2025-13465 openshift-gitops-1/console-plugin-rhel8: prototype pollution in _.unset and _.omit functions [gitops-1.17]) * GITOPS-8979 (CVE-2025-61726 openshift-gitops-1/argo-rollouts-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8980 (CVE-2025-61726 openshift-gitops-1/argocd-agent-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8981 (CVE-2025-61726 openshift-gitops-1/argocd-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8982 (CVE-2025-61726 openshift-gitops-1/argocd-rhel9: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8983 (CVE-2025-61726 openshift-gitops-1/dex-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8984 (CVE-2025-61726 openshift-gitops-1/gitops-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8985 (CVE-2025-61726 openshift-gitops-1/gitops-rhel8-operator: Memory exhaustion in query parameter parsing in net/url [gitops-1.17]) * GITOPS-8486 (CVE-2025-66418 openshift-gitops-1/console-plugin-rhel8: urllib3: Unbounded decompression chain leads to resource exhaustion [gitops-1.17]) * GITOPS-8487 (CVE-2025-66418 openshift-gitops-1/must-gather-rhel8: urllib3: Unbounded decompression chain leads to resource exhaustion [gitops-1.17]) * GITOPS-8641 (CVE-2025-66471 openshift-gitops-1/console-plugin-rhel8: urllib3 Streaming API improperly handles highly compressed data [gitops-1.17]) * GITOPS-8683 (CVE-2026-21441 openshift-gitops-1/console-plugin-rhel8: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) [gitops-1.17])
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This security advisory covers multiple vulnerabilities in Red Hat OpenShift GitOps prior to version 1.17.5. The most notable is CVE-2025-12816, an interpretation conflict vulnerability in the node-forge library that allows unauthenticated attackers to bypass cryptographic verifications by crafting malicious ASN.1 structures, causing semantic divergence in schema validation. Other vulnerabilities include prototype pollution (CVE-2025-13465), memory exhaustion in query parameter parsing (CVE-2025-61726), and resource exhaustion via unbounded decompression chains (CVE-2025-66418 and CVE-2026-21441). These issues affect multiple components such as console-plugin, argocd, dex, and gitops operators. Red Hat has released version 1.17.5 of OpenShift GitOps containing fixes for these vulnerabilities.
Potential Impact
Exploitation of CVE-2025-12816 could allow unauthenticated attackers to bypass cryptographic verification and security decisions, potentially undermining the integrity and confidentiality of affected systems. Other vulnerabilities may lead to prototype pollution, memory exhaustion causing denial of service, and resource exhaustion through decompression bomb attacks. These impacts can degrade system reliability and security. No known active exploitation has been reported.
Mitigation Recommendations
An official security update is available in Red Hat OpenShift GitOps version 1.17.5 that addresses these vulnerabilities. It is recommended to apply this update after ensuring all prior relevant errata are applied. No effective mitigations meeting Red Hat's criteria are currently available other than upgrading. Users should follow Red Hat's published guidance for applying the update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:3869
- Cve Count
- 6
- Additional Cves
- ["CVE-2025-13465","CVE-2025-61726","CVE-2025-66418","CVE-2025-66471","CVE-2026-21441"]
- State
- PUBLISHED
Threat ID: 6a160964e29bf47b5062979e
Added to database: 05/26/2026, 20:58:12 UTC
Last enriched: 08/10/2026, 17:34:58 UTC
Last updated: 09/13/2026, 10:01:26 UTC
Views: 129
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.