CVE-2025-71319 is a denial of service vulnerability in the image-size component utilized by Red Hat Trusted Artifact Signer (RHTAS) Operator for OpenShift Container Platform versions 4.17 to 4.22. The vulnerability arises from the findBox function entering an infinite loop when processing maliciously crafted JXL, HEIF, or JP2 image files containing zero-sized boxes. This infinite loop causes the application to hang, resulting in resource exhaustion and impacting availability of services relying on this image processing library. The vulnerability is classified under CWE-835 (Infinite Loop) and has a Red Hat CVSS v3 base score of 7.5 with high impact on availability. No fix or mitigation meeting Red Hat's criteria is currently available, and the issue remains under investigation for remediation.

This vulnerability can cause a denial of service by making the affected application hang indefinitely when processing specially crafted image files. This impacts the availability of services relying on the image-size component within Red Hat Trusted Artifact Signer and potentially other dependent Red Hat products. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been reported.

Currently, no official fix or mitigation meeting Red Hat's criteria for ease of deployment and applicability is available. Users should monitor Red Hat advisories for updates. Until a fix is released, avoid processing untrusted JXL, HEIF, or JP2 image files with zero-sized boxes in environments using the affected versions of Red Hat Trusted Artifact Signer. Customers with Red Hat Technical Account Managers can seek direct guidance. Upgrading to a future fixed version when available is recommended.