VDB
RHSA-2025%3A19380
RHSA-2025%3A19380
PUBLISHED
CVSS 7 HIGH
A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application.
Risk Scores
CVSS 3.1
7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:7e81ff2323a78a5fe129341f9d5f76bf10281cae3200aecd041a4beff1cb6f60_arm64 as a component of multicluster engine for Kubernetes 2.9.0 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:7e81ff2323a78a5fe129341f9d5f76bf10281cae3200aecd041a4beff1cb6f60_arm64 as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:7e81ff2323a78a5fe129341f9d5f76bf10281cae3200aecd041a4beff1cb6f60_arm64 |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:298856ac98371e67ec2e80aed138a658883d412a9920c481c0f4deb8acae7f9c_amd64 as a component of multicluster engine for Kubernetes 2.9.0 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3c2e9356f0bb37df08f3d71c3a86d6fcdfa8e507a170a03a8189a0b84c7546b5_ppc64le as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:af83216b5d9133295c322c769da53110b525900ab1be1bc5d6285cc735d939dc_arm64 as a component of multicluster engine for Kubernetes 2.9.0 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:b8e2c62b5e549c418a4fd0955d10e3b2a1820980f23c8b3190bf30291f4b4520_s390x as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:b8e2c62b5e549c418a4fd0955d10e3b2a1820980f23c8b3190bf30291f4b4520_s390x |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:aed5dfdcb0ee1ba8f6c8bdd015fdce09ba1e587c67fbdf87dbefd26526c7ec52_amd64 as a component of multicluster engine for Kubernetes 2.9.0 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e2f7dee46f99e471670dbe6092ceb343fd9b72b4a918ada47408d4ef4a5f8868_s390x as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:aed5dfdcb0ee1ba8f6c8bdd015fdce09ba1e587c67fbdf87dbefd26526c7ec52_amd64 as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:aed5dfdcb0ee1ba8f6c8bdd015fdce09ba1e587c67fbdf87dbefd26526c7ec52_amd64 |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:1facf3f046fb257c3625a79a91973c991005500f9b883f9cbc93a3e82c3c3869_arm64 as a component of multicluster engine for Kubernetes 2.9.0 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a68de20386cd773e90e0d9132f06b91c53b461dafe1479e27a5ace0818f4792b_amd64 as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6686e0ad44636396a85ceeaef061239ebd0074aae9918a9acd853f06452fe338_s390x as a component of multicluster engine for Kubernetes 2.9.0 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:799d9b838f43e2e793006886f0c2b95ba7d19348b758380af26be4d340d09107_ppc64le as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a68de20386cd773e90e0d9132f06b91c53b461dafe1479e27a5ace0818f4792b_amd64 as a component of multicluster engine for Kubernetes 2.9.0 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:b8e2c62b5e549c418a4fd0955d10e3b2a1820980f23c8b3190bf30291f4b4520_s390x as a component of multicluster engine for Kubernetes 2.9.0 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:d25be8f16424ea9b44d2445c9cd110dec9dcbebd7d548538abaf104016996131_arm64 as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:1facf3f046fb257c3625a79a91973c991005500f9b883f9cbc93a3e82c3c3869_arm64 as a component of multicluster engine for Kubernetes 2.9 | * |
| golang | database/sql | |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:7487489606b42c61062c2f6c5d4d4faff1aa8b0bab20bebb4f87d2c97281f697_arm64 as a component of multicluster engine for Kubernetes 2.9.0 | * |
| Red Hat | registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7b3b4fbf1d5572a21fe71c9d67a4bc49d5ee1cb65617df73aa3cbc8a7c03667_ppc64le as a component of multicluster engine for Kubernetes 2.9 | * |
…and 21 more
Timeline
- Oct 30, 2025 CVE Published
- May 7, 2026 Distribution Patch
- May 7, 2026 Distribution Patch
- May 7, 2026 Security Advisory
- May 7, 2026 Security Advisory
- Jul 26, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:19380 advisory
- https://access.redhat.com/security/cve/CVE-2025-47907 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/updates/classification/#low advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19380.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2387083 issue
- https://www.cve.org/CVERecord?id=CVE-2025-47907 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47907 advisory
- https://go.dev/cl/693735 advisory
- https://go.dev/issue/74831 advisory
- https://groups.google.com/g/golang-announce/c/x5MKroML2yM advisory
- https://pkg.go.dev/vuln/GO-2025-3849 advisory