RHSA-2025:21148MediumCVSS 7.5

Red Hat Security Advisory: Red Hat build of Cryostat 4.1.0: new RHEL 9 container image security update

Published
November 25, 2025
Last Modified
September 5, 2026

🔗 CVE IDs covered (2)

CVE-2025-58056 →CVE-2025-47907 →

📋 Description

CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-58056 — netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

🎯 Affected products21

  • Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:6131bab8c57f7608d37771c0bbd0ba17daec52b641074ad86384a2dbbb43ddfd_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:bbaf34588cfb337f4324c9caf2a8497610d69099291cbd573922478b7b7ee447_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:17cbab7fe73eb58acb9839aac0f0cf12252807df24b1239e8524c59c4fc8e7e1_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:bb55018720bf3d6d84acaa9838c1784eeec9c9e087a68e269182fd1f4444c825_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:1a88153e3a6f9e5c50a99169cc85e6be87765958a1e5df236e48f3a1643f71ba_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:c2e5d2779e6c54dd165e601f5238ab60b6b75cb444ccb5b28a32b8ee6cb68d9a_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:7e33533e0ff3deeccabbd5fb42a72e27947137bacae8229470e2851e1f575dee_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:ecacef779a92182ca35c0c174cf3264855e3b7e4a842713073d26fc5e21fa99f_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:1576edbc051949f855996b297e7f36015186ef1f883d8f8d66442011d09572c5_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:cfc2970ea2ff3d0f5dbe777fd8bcb2962a3fa123aa7692c48978960aa09011c4_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:199cef0b50b631e9a8e0190430956d2274a6b0ccd56d4a8526f26a66e52d5f66_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:f1d16268cde3d09c07461a5f9f89f1919dc0e870b49805c66b827f92a2950678_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:32cacdcb0bb6f2cd20030c44d8b0f189e1f437e765cdf1c1d8d4168baaaa8986_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:eab8668b44394815a3e6ac3dfa7223660d8157bfc79e1bce9a6805f4fb9a4f9d_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:757af424dad995da441b5a104cf2105228aa81155b930ddecb107c8995d35002_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:896d478190a4db75aa48f27b8924ac549e389279d0bccc55af441e3dedbcede9_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:0f761afdc28f562ab3802015a077a0be8138f95dbe5bc79314fa8536d9a8ec6e_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:4f111af2b04b9790e679fbcaf0b972f2cc9ffd81bff1e050e1ee16d67934b4d1_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:4b57bfa593719ddd8c42e68593aef24c5bdb9fee0916dc47922e2a012ac58bd0_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:58161e06e4ee52211100dc245d37732930d9342e067ac5e747adb752197239ee_amd64 as a component of Cryostat 4 on RHEL 9

✅ Remediation

You can download the Cryostat 4 on RHEL 9 container images that this update provides from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available in the Red Hat Container Catalog (see the References section). Dockerfiles and scripts should be amended to refer to this new image specifically or to the latest image generally. Workaround: To mitigate this issue, enforce strict RFC compliance on all front-end proxies and load balancers so that lone LF characters in chunk extensions are rejected or normalized before being forwarded. Additionally, configure input validation at the application or proxy layer to block malformed chunked requests, ensuring consistent parsing across all components in the request path.

🔗 References (5)