VolSync v0.14 enables asynchronous replication of persistent volumes within or across Kubernetes clusters. Several security vulnerabilities affect this version, notably CVE-2025-61726, which involves the Go standard library's net/url package failing to limit the number of unique query parameters parsed. An attacker can send a specially crafted HTTP request with a large number of query parameters, causing excessive memory consumption and denial of service in applications using net/http.Request.ParseForm. Red Hat has issued an advisory (RHSA-2026:11408) detailing these issues and released VolSync v0.14.2 with security fixes and updated container images. The vulnerabilities are rated as important or high severity, with no known exploits in the wild. The advisory references multiple CVEs and CWE identifiers related to resource exhaustion and improper resource allocation.

Exploitation of CVE-2025-61726 can cause applications using the vulnerable Go net/url package to consume excessive memory when processing HTTP requests with many unique query parameters, leading to denial of service by crashing or making the application unresponsive. There is no impact on confidentiality or integrity. The overall security impact of the VolSync vulnerabilities is rated as important/high by Red Hat. No known active exploits have been reported.

Red Hat has released VolSync v0.14.2 which includes security fixes and updated container images addressing these vulnerabilities. Users should upgrade to VolSync v0.14.2 or later as soon as possible. No practical mitigations other than updating the affected package have been identified. Red Hat manages remediation for this product via official updates. Users should consult the Red Hat Advanced Cluster Management for Kubernetes documentation and the advisory RHSA-2026:11408 for detailed guidance.