CVE-2025-47950 is a memory exhaustion vulnerability in CoreDNS related to its handling of QUIC traffic streams. The CoreDNS server spawns a new goroutine for each incoming QUIC stream without any limit, enabling an attacker to create an unlimited number of streams and exhaust system resources. This flaw results in an application-level denial of service by consuming CPU and memory resources. The vulnerability affects Red Hat Advanced Cluster Management for Kubernetes from version 2.13 onward, specifically in the Submariner operator that enables cross-cluster connectivity in Kubernetes environments. Red Hat has released security fixes and updated container images in Submariner v0.20.2 to address this issue. The impact on Red Hat systems is limited to CoreDNS service availability and does not compromise the host system. Mitigation includes upgrading to the fixed version or disabling QUIC protocol support if upgrading is not feasible.

The vulnerability allows an attacker to cause a denial of service by exhausting memory and CPU resources on the CoreDNS service through unbounded QUIC stream creation. On Red Hat systems, this denial of service affects only the CoreDNS service availability and does not impact the overall host system availability. Therefore, the availability impact is assessed as low for Red Hat deployments.

A fix is available in Submariner v0.20.2 release images provided by Red Hat Advanced Cluster Management for Kubernetes 2.13 and later. Users should upgrade to these updated versions to remediate the vulnerability. For users unable to upgrade immediately, manually disabling QUIC protocol support in CoreDNS is recommended as a temporary mitigation to prevent exploitation.