RHSA-2025:14919HighCVSS 7.5

Red Hat Security Advisory: Red Hat build of Cryostat 4.0.2: new RHEL 9 container image security update

Published
September 3, 2025
Last Modified
August 22, 2026

🔗 CVE IDs covered (3)

CVE-2025-7783 →CVE-2025-8415 →CVE-2025-55163 →

📋 Description

CVE-2025-7783 — form-data: Unsafe random function in form-data CVE-2025-8415 — cryostat: authentication bypass if Network Policies are disabled CVE-2025-55163 — netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability

🎯 Affected products23

  • Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:0e5ffd83db750fb85c1e6e268a6be392bf084558e9b07d29bb6b752b756f98e8_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:d6d38a85fabf58e7dabcc9088f0c5271f1f03616e883175ad67081232fd08189_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:98289ddd46c3b9e3ed22cb76f4f5372b28d84637f84e0e24fcfd75f1b6cdfc4c_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:a598e40bbe2ce6243d1eb583dc57041c4ced8a4a5bcba2d0a4f9d8decc8bfb5e_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:1b2c837ef2ae61f187d4d3b7be3f9fb3a2f8910d99a5b7d02929edb993631cc9_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:7c1d1bee4b41222a89ccff05f96c718c230779cd123c33ce5150c1c6df69abe4_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:04c736cd3efff1a2d894bd7bfb2d982cc2de938aeb859ce01fe5c237275305a5_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:72e93e32df5c0af848dfae42aee3633069df0cbdaacfc4bb9c68b54a161c1bd9_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:52f04cfb6bbc0a04ef61a1d061e45dc4a44e98fba9413961d69a6a97cf45e084_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:808f35402b5b20c395a26436d6a121fb8e81ff56fd6a60e8e84ad8e4f64d37d4_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-ose-oauth-proxy-rhel9@sha256:a049c80f0fdbdd21ee6513c703b057aae78259e2077357b84a3faf01a002db1f_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-ose-oauth-proxy-rhel9@sha256:de2537a6036e88a9eb3821851b1f8e3fcaa069d46f18e9a999848058c2923872_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:2eef8c97381bc0c8418be415384f2cef5b59bcc2f286fe65fc18873d8719c628_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:577db510c36a906d7583f9daec87f1df593167ecaac881573a9fb9511e7786c0_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:a2b8104352ac48cf5a076e0a4ab48e435535913e1f0301ba69bc7c4ff1ea70c2_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:a4dd6911c3fcd3b1fffcb24b54f798cfd1f1113020556685333d8c8e3857a9ca_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:54fd86c9f83b0a690b5a2effd8bb1c1a91440c284f5c7c64a603bb62bb915e6f_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:813522e91ba44510abfb6802cfbfe0dbdde1df678fb72c0954458d9485ff9469_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:0468feecc78f056ed30ab07ec3d8b53d0be37f4a00d49009ea6e3f9b20c9c509_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:415e55fd5a49c4de08af32f2efa76de4f5bbeeb48e868de5f8cdb79d7c8ce526_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:36f0386024588220c316c6dcc442a709491d5d6adb217ae1dd8dd1aca7c6b94a_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:3c714df80db3d94b1e70cd81fd70b5f012f5e85b9cc974d8a56d0eb59174a823_arm64 as a component of Cryostat 4 on RHEL 9

✅ Remediation

You can download the Cryostat 4 on RHEL 9 container images that this update provides from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available in the Red Hat Container Catalog (see the References section). Dockerfiles and scripts should be amended to refer to this new image specifically or to the latest image generally. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Cryostat is not vulnerable by default, as Network Policy is enabled and prevents this behavior. Make sure the Network Policies are enabled in Custom Resources and that the underlying cluster network stack supports Network Policies. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

🔗 References (6)