This Red Hat security advisory (RHSA-2025:8670) announces the release of OpenShift Serverless Logic 1.36.0, which includes fixes for multiple vulnerabilities such as CVE-2025-22866 and CVE-2025-22871. The update addresses issues categorized under CWE-200 (Information Exposure) and CWE-444 (Inconsistent Interpretation of HTTP Requests). The advisory rates the security impact as moderate/important but does not provide CVSS scores. The update applies to Red Hat OpenShift Serverless 1 for RHEL 8 across multiple architectures including x86_64, ppc64le, s390x, and aarch64. No known exploits are currently reported in the wild. The vendor recommends applying this update after all previous errata are installed.

The vulnerabilities addressed in this update have been rated with a moderate security impact by Red Hat. They involve information exposure and inconsistent interpretation of HTTP requests, which could potentially lead to unauthorized information disclosure or unexpected behavior in OpenShift Serverless Logic components. However, no active exploitation has been reported. The update mitigates these risks by applying bug fixes and enhancements.

Red Hat has released OpenShift Serverless Logic 1.36.0 as an official fix for these vulnerabilities. Users should apply this update to their affected OpenShift Serverless installations on RHEL 8. Before applying the update, ensure all previously released errata relevant to the system have been applied. Detailed update instructions are available at Red Hat's official documentation (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated by the vendor.