The advisory covers three security vulnerabilities affecting Submariner 0.19.4 container images used in Red Hat Advanced Cluster Management for Kubernetes 2.12 on RHEL 9. CVE-2024-53259 involves an ICMP Packet Too Large Injection Attack affecting the quic-go library on Linux, potentially allowing malicious packets to disrupt networking. CVE-2025-22868 is a vulnerability in golang.org/x/oauth2/jws causing unexpected memory consumption during token parsing, which could lead to resource exhaustion. CVE-2025-30204 affects golang-jwt/jwt, allowing excessive memory allocation during JWT header parsing, also risking denial of service. The advisory provides updated container images with fixes for these issues. No CVSS base scores are provided, but Red Hat rates the overall impact as important (high severity).

The vulnerabilities could allow an attacker to cause denial of service or resource exhaustion by exploiting memory consumption flaws or injecting malicious ICMP packets. This could disrupt networking between Kubernetes clusters managed by Submariner, impacting cluster communication and service availability. No known active exploitation has been reported, but the issues pose a significant risk to cluster stability and security if left unaddressed.

Red Hat has released updated Submariner 0.19.4 container images for Red Hat Advanced Cluster Management for Kubernetes 2.12 on RHEL 9 that fix these vulnerabilities. Users should apply these updates promptly to mitigate the risks. The advisory does not indicate any temporary workarounds or that no action is required. Patch status is confirmed by the vendor advisory. Refer to the official Red Hat advisory RHSA-2025:4250 for detailed update instructions.