This advisory covers security fixes in Submariner 0.20.1 container images used in Red Hat Advanced Cluster Management for Kubernetes 2.13 on RHEL 9. It addresses two vulnerabilities: CVE-2025-22871, a request smuggling vulnerability in the net/http package caused by acceptance of invalid chunked data, and CVE-2025-30204, an issue in golang-jwt/jwt allowing excessive memory allocation during JWT header parsing. These flaws could potentially be exploited to disrupt network communication or cause resource exhaustion. The update includes bug fixes and enhancements to mitigate these issues.

The vulnerabilities fixed in this update have a high security impact rating. CVE-2025-22871 involves request smuggling due to improper handling of invalid chunked HTTP data, which can lead to unexpected behavior in HTTP request processing. CVE-2025-30204 allows excessive memory allocation during JWT header parsing, potentially leading to denial of service through resource exhaustion. These issues affect networking components in Kubernetes cluster management, which could impact cluster communication and stability if exploited.

Red Hat has released Submariner 0.20.1 with fixes for the identified vulnerabilities. Users of Red Hat Advanced Cluster Management for Kubernetes 2.13 on RHEL 9 should update to this version to apply the security patches. No additional mitigation steps are indicated beyond applying the updated container images provided by Red Hat. Patch status is confirmed by the vendor advisory.