RHSA-2026:2368HighCVSS 7.7

Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.18.1-2 Update

Published
February 9, 2026
Last Modified
August 10, 2026

🔗 CVE IDs covered (2)

CVE-2025-68156 →CVE-2025-68476 →

📋 Description

CVE-2025-68156 — github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation CVE-2025-68476 — github.com/kedacore/keda: KEDA: Arbitrary file read vulnerability in Vault authentication

🎯 Affected products18

  • Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:2f25021a561f15be90c5bca9bfafc43f9c8e142c75d1fc9ee317ab0943b7054e_ppc64le as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:57e58fa24aed52d153adb8e9eb2b97c7cc7144723bea8b92fb0f518c864e5003_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:7f9e53e5a6aa6670ab29f6e0001326f75393a17efb515bf174d4c9515c152758_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:cf3f3bf999c1065bc3d0b7580bd922daec789f98da5812069cea1333520f876b_s390x as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:53a8ffbe94da6658c66bcf8d85e2e113f7bd85cff3f42a258e5ce6662ec2cb1d_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:6a90e03aefc5449d621907b8144acf3637b6a9705e50d6dda58a3ad3f112ac1c_s390x as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:ad045c0a324d63ac1fd3277233a96606f91dc32268ad94e6676d3081fa8ea8d1_ppc64le as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:c25f659d9e7e50206a86e3617efbc7f2f4b750ced52fcc18a38bf03b4d89660a_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle@sha256:e746b1aafcdcd82a6d2d069478d2870ada48c9f026d3119fc0977b333138c4ba_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:1a99333dd543488726051028e58eea4eaf5585a5993264faffbb7ccc151fc83e_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:5aedc4d3b27cba4acf7599e88cf0716cf47f6374f150237508d87f29094cf70d_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:7c238fccaf2517e70f439cfbb860a7fbeaa27e6a295bc6a85b321179d65b2b23_s390x as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:b9ec010e078cab2c432f2b240b8b8940a5fb6dbc347138215b80f7131f1435d0_ppc64le as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:7e8fb81460623c77a7c45c5e4b48e09d1da9e3441f8eb01be33f4ac5318b82a1_s390x as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:a02f9d2ff968196d532f9ca1858ec1ea3ca81726f111df22cf28bb6d7818f2ca_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:d0a2e099d9b87ceb1aa7b716a325c446172d1f4b365352e3c275dbfb604cd7b2_ppc64le as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:e4a1bf51de7f95506dc58db125188c07d82b64aad83052c81c2262f8613af98d_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, applications using the `Expr` library should ensure that evaluation environments do not contain cyclic references. Additionally, externally supplied data structures must be validated or sanitized before being passed to `Expr` for evaluation. As a last-resort defensive measure, expression evaluation can be wrapped with panic recovery to prevent a full process crash.

🔗 References (5)