The Red Hat OpenStack Platform (RHOSP) director Operator for version 17.1 includes several security fixes. Among them, CVE-2025-58183 is a vulnerability in the Go archive/tar package where the tar.Reader does not limit the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive can cause unbounded memory allocation, leading to an out-of-memory condition and denial of service. Other fixed vulnerabilities include session resumption issues in crypto/tls (CVE-2025-68121), memory exhaustion in query parameter parsing in net/url (CVE-2025-61726), and excessive resource consumption in crypto/x509 (CVE-2025-61729). Red Hat has released updated container images to mitigate these issues.

Exploitation of CVE-2025-58183 can cause a Go application processing a malicious GNU tar pax 1.0 archive to allocate excessive memory, resulting in denial of service due to out-of-memory conditions. The other vulnerabilities similarly lead to resource exhaustion or unexpected session resumption, potentially impacting availability. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Red Hat has released updated container images for the RHOSP director Operator 17.1 that address these vulnerabilities. Users should pull and deploy the updated images from the Red Hat container registry using 'podman pull'. No other mitigations are currently available or meet Red Hat's criteria for ease of use and applicability. Patch status is confirmed by the vendor advisory. Users should follow Red Hat's official guidance and update promptly.