Red Hat Security Advisory: Submariner v0.20 security fixes and container updates
Submariner is a Kubernetes operator that enables cross-cluster connectivity for services and pods, implementing KEP-1645 (Multi-Cluster Services API). After deploying the Submariner operator, it can enable direct networking between pods and services across different Kubernetes clusters. For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.
AI Analysis
Technical Summary
CVE-2025-47950 is a memory exhaustion vulnerability in CoreDNS related to handling QUIC traffic streams. The CoreDNS server spawns unlimited goroutines for each incoming QUIC stream, enabling an attacker to exhaust system resources by creating many QUIC streams. This vulnerability affects CoreDNS components used in Red Hat Advanced Cluster Management for Kubernetes, specifically in Submariner v0.21 and related container images. The flaw results in an application-level denial of service impacting the CoreDNS service but not the host system. Red Hat has issued security advisories and released patched container images to fix this issue. Mitigation includes disabling QUIC protocol support if upgrading is not possible.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by exhausting memory resources on the CoreDNS service through unbounded QUIC stream creation. On Red Hat systems, this denial of service impacts only the CoreDNS service and does not take down the host system, resulting in a low availability impact for the overall system.
Mitigation Recommendations
Red Hat has released official security fixes and updated container images in Submariner v0.21 and Red Hat Advanced Cluster Management for Kubernetes v2.14 to address this vulnerability. Users should apply these updates to remediate the issue. If upgrading is not immediately possible, users can manually disable QUIC protocol support in CoreDNS as a temporary mitigation.
Red Hat Security Advisory: Submariner v0.20 security fixes and container updates
Description
Submariner is a Kubernetes operator that enables cross-cluster connectivity for services and pods, implementing KEP-1645 (Multi-Cluster Services API). After deploying the Submariner operator, it can enable direct networking between pods and services across different Kubernetes clusters. For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-47950 is a memory exhaustion vulnerability in CoreDNS related to handling QUIC traffic streams. The CoreDNS server spawns unlimited goroutines for each incoming QUIC stream, enabling an attacker to exhaust system resources by creating many QUIC streams. This vulnerability affects CoreDNS components used in Red Hat Advanced Cluster Management for Kubernetes, specifically in Submariner v0.21 and related container images. The flaw results in an application-level denial of service impacting the CoreDNS service but not the host system. Red Hat has issued security advisories and released patched container images to fix this issue. Mitigation includes disabling QUIC protocol support if upgrading is not possible.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by exhausting memory resources on the CoreDNS service through unbounded QUIC stream creation. On Red Hat systems, this denial of service impacts only the CoreDNS service and does not take down the host system, resulting in a low availability impact for the overall system.
Mitigation Recommendations
Red Hat has released official security fixes and updated container images in Submariner v0.21 and Red Hat Advanced Cluster Management for Kubernetes v2.14 to address this vulnerability. Users should apply these updates to remediate the issue. If upgrading is not immediately possible, users can manually disable QUIC protocol support in CoreDNS as a temporary mitigation.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:21892
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-59530"]
- Cvss Version
- null
Threat ID: 6a4049d127e9c7971982b922
Added to database: 06/27/2026, 22:08:17 UTC
Last enriched: 08/16/2026, 16:25:38 UTC
Last updated: 08/21/2026, 10:52:06 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.