RHSA-2025:3993HighCVSS 7.5

Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.15.1-6 Update

Published
April 17, 2025
Last Modified
July 30, 2026

🔗 CVE IDs covered (2)

CVE-2025-29786 →CVE-2025-30204 →

📋 Description

CVE-2025-29786 — github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products10

  • Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:0166a9dc52e4b24030198460a061dc4fc649e6007b99213a38496aada2aaaba6_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:37f8337ab2ecf2c6023a5813c66d3dfb2a09176772a7a8dc24e2ebfd543aceb2_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:6e8caff3ab7ad5e103fa809f4be7a672c7ef3d9f86f26afeb9d275bdd58d73d8_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:da1e3c2b2b151b918791058c20bba72f4a29dc87f3b0c8b3a0ba316d0f42b78d_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle@sha256:623280ae8997a354e5fb3275afaf0d2bb5d260b5bae0c7f56b858b7dc33a1e48_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:7ed1cf4aab0cdc460733c8a5bef79476e015be75322beec2908c54b97b71568c_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:a8b5fa8dbd33ae84baa4c3f04a7429ffa509bafe8ec275a19232ff23d742566c_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:e25cd6d10cc023428bfb3c82a8a59ff0620ac835a326a01ef5ea79688cbfc800_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:f4cae34187a11abd88edc84bb0e78da3fe4e54bbe3845ca34819de2efd9f6b61_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.15

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/operators/administrator-tasks#olm-upgrading-operators Workaround: To mitigate this vulnerability, it is recommended to impose an input size restriction before parsing (i.e. validating or limiting the length of expression strings that the application will accept). Ensuring no unbounded-length expressions are fed into the parser will prevent the parser from constructing a very large AST and avoid the potential memory exhaustion issue. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (5)