RHSA-2025:3886HighCVSS 7.5

Red Hat Security Advisory: RHOAI 2.19.0 - Red Hat OpenShift AI

Published
April 15, 2025
Last Modified
August 18, 2026

🔗 CVE IDs covered (2)

CVE-2025-22868 →CVE-2025-26791 →

📋 Description

CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-26791 — dompurify: Mutation XSS in DOMPurify Due to Improper Template Literal Handling

🎯 Affected products35

  • Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:ed1221a6e826166806ec6e18e42e098cb97767471059527c7fc6f47b8d6fb58a_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:271879affee3a08fc827f6c0e8fb4c06eab240a7f0d78dd2ceeef20c81a5ae40_ppc64le as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:2f89b93b906739da7ad1c00e4ede3617e779fe6c02a10e566ea2bb742a713003_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:5c731221878716866bfeaa1f85a7ed5323592b23d3751e489794d0087ad16a0e_s390x as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8@sha256:58ad80b2ec191778631287f5f10608db1623e8ba82d220860d81df246083de11_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8@sha256:2760fe9bd0846bdad2d6586254e6e0ada18c03ac02ffc5313ead7d187f66a9a2_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel8@sha256:7bfbec509400d0642d39ca59f4389e4daed9ea1fb39fbb549eb182edc10929ac_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel8@sha256:57b6c232523d4ab6faafab37c4ecdad4683e27c82719223499032f42c1a24ee1_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-kuberay-operator-controller-rhel8@sha256:823f3fe491aa906352805f71d57fc446e11327f5a6f5fca42cce044ddc41c308_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-kueue-controller-rhel8@sha256:306fa16ce1899be0dfeaba34e225c958592135ec4dde3c44e7f920fbed11937e_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel8@sha256:da649491f5112763d9f563d64ca3455ed5e4309b15adab0886ae16e0bb367b0c_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel8@sha256:74e233642eb1b544ab9c3b260251bba8c11dd9015563110921940e9e5976bdd5_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel8@sha256:31412062bc02196bca820b65fa2492bdac6ffc8b5d1add729806144ef2aca919_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8@sha256:4e0c858d68f925a307ee53498aa6019563254c5b27f5d7635debc0195db2c5bd_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-ml-pipelines-runtime-generic-rhel8@sha256:5040cf36b6261d20826df3ca408d11a186db7840560a667a24c68d78cadb9e35_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8@sha256:99ca5a981184f0dd3f94105172b20494328c5c7a762fb027905e108710b7b5d4_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:56c432c302bec0a7b810e037da5c649da39a5180a4fabf2fb3d0a2ac2e53ecd3_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-mm-rest-proxy-rhel8@sha256:f0167ad11880010c6247dce02e4d1b2ec969222976c5b12612ee10bbf3fb4d18_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-model-controller-rhel8@sha256:0aefcdfbf2a3979576f5ddbfd1a0dac0be972b9b501d93ef7cd4a38491e2fa03_ppc64le as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-model-controller-rhel8@sha256:523cff7ef18c252777e211f5b1f4749110c081c1414a3df4fe9de5b4832c3922_s390x as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-model-controller-rhel8@sha256:c013d3d264d3ef15e21ab2a3d5a08ddd725e54d8474f2d8b7e400d4d9e76ff44_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-model-registry-operator-rhel8@sha256:fe5905f3206cfe7600682337e29c15bc6dd7285575fd9b3815b697bbdefa3de1_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-model-registry-rhel8@sha256:b13d5304310c839720b99cd984a69482f5968663d3124feaaf1c2db0b2715cd6_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:43d98c254ad76c2eefc48a56e84e4083281c72e8b9ae38e49dfb6d5751bdb895_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-modelmesh-runtime-adapter-rhel8@sha256:12d75776a60c119d938dec28625f574f5d55a2616c49bb8773e5b87ba3141280_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-modelmesh-serving-controller-rhel8@sha256:f3d8cc96fd3415efed5b5d69b7db622adc32cd9bd74ff14634d02218f1572815_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-notebook-controller-rhel8@sha256:efa0c07e1cd20fdce0998aab507b8943e5eacbb464bc969bf1c7e9785a474eca_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-operator-bundle@sha256:9668d85dd7a401d0fb9c4b55f92385b9626fc07f46de2bf900994774b06bda35_amd64 as a component of Red Hat OpenShift AI 2.19
  • registry.redhat.io/rhoai/odh-rhel8-operator@sha256:65bbc1f8225e1ddbf26a08003b10e4f93f1dc00f1ae2e23b20fc97b30eb288dc_s390x as a component of Red Hat OpenShift AI 2.19
  • +5 more not shown

✅ Remediation

For Red Hat OpenShift AI 2.19.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.

🔗 References (6)