This advisory covers a moderate security update for Red Hat OpenShift Serverless Logic 1.36.0 that addresses multiple vulnerabilities including CVE-2025-22866 and CVE-2025-22871. The vulnerabilities involve information exposure (CWE-200) and improper control of resource identifiers (CWE-444). The update includes bug fixes and enhancements but does not specify detailed technical exploit methods or impacts. The vendor rates the update as having an Important security impact but does not provide a CVSS score. The update is applicable to several Red Hat OpenShift Serverless builds across multiple hardware architectures. No known exploits in the wild have been reported. The vendor advisory recommends applying this update after all prior relevant errata have been applied.

The vulnerabilities addressed may allow unauthorized information disclosure or improper resource identifier control, potentially impacting confidentiality and system integrity. However, no active exploitation has been reported, and the vendor rates the security impact as Important (moderate severity). The lack of a CVSS score limits precise severity quantification. The update mitigates these issues through bug fixes and enhancements.

A security update for OpenShift Serverless Logic 1.36.0 has been released by Red Hat and should be applied to affected systems. Before applying this update, ensure all previously released errata relevant to your system are installed. Follow Red Hat's official guidance for applying updates: https://access.redhat.com/articles/11258. There are no indications that additional mitigations beyond applying the update are required.