VDB
RHSA-2025%3A23528
RHSA-2025%3A23528
PUBLISHED
CVSS 7.5 HIGH
A denial of service attack was found in prometheus/client_golang. This flaw allows an attacker to produce a denial of service attack on an HTTP server by exploiting the InstrumentHandlerCounter function in the version below 1.11.1, resulting in a loss of availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:85c952b2c34b2d99199b2583e87e3c2ccbe900d837686e67ffb75ae13c40b4b0_ppc64le as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:8917c1b09e582743ed4ea5df46213685de969bfbff656d039c2bc6c848772711_ppc64le as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/work-rhel9@sha256:f7a99f270874b02b1c51c212be708d32fb25ff2f91a64760d1c7eb2c925329ee_amd64 as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:07356ef57ffb077fc52ce681910916fbc927c581e2447ccbe60e4086b8d81b09_ppc64le as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/placement-rhel9@sha256:b3570ec2a487b8cfde96dc5eb8c1b1652d085af60ee5bdbdbcf20395520633e5_s390x as a component of multicluster engine for Kubernetes 2.6 | registry.redhat.io/multicluster-engine/placement-rhel9@sha256:b3570ec2a487b8cfde96dc5eb8c1b1652d085af60ee5bdbdbcf20395520633e5_s390x, * |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c01b60d63e12ff2538e4df40962c4a842ecbd5dabef3beccbbccc584f4373bcd_s390x as a component of multicluster engine for Kubernetes 2.6 | registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c01b60d63e12ff2538e4df40962c4a842ecbd5dabef3beccbbccc584f4373bcd_s390x, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c01b60d63e12ff2538e4df40962c4a842ecbd5dabef3beccbbccc584f4373bcd_s390x |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:35139f01f0234131d8f2057ccd46697352c9c1e02a8e7ec70e30a367e06944ae_amd64 as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:e4dc1107ca9f5c3e7cf3575d021838dde38a3cecb3b12236939d0beb6db0e459_arm64 as a component of multicluster engine for Kubernetes 2.6 | registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:e4dc1107ca9f5c3e7cf3575d021838dde38a3cecb3b12236939d0beb6db0e459_arm64, registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:e4dc1107ca9f5c3e7cf3575d021838dde38a3cecb3b12236939d0beb6db0e459_arm64 |
| Red Hat | registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:6575a549657eb7a0c51235fa9ce1ce4b601cd532e5a5e6e6a5a9513eda3215a3_amd64 as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/registration-rhel9@sha256:69533bf9db1b3c322257d5c6c3f058c87888b70993b08cb90c81c1b9df7c4073_amd64 as a component of multicluster engine for Kubernetes 2.6 | *, registry.redhat.io/multicluster-engine/registration-rhel9@sha256:69533bf9db1b3c322257d5c6c3f058c87888b70993b08cb90c81c1b9df7c4073_amd64 |
| Red Hat | registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:56b2688587848e11ba6ef689f457bcc047a54da19a8323c135d1caa3df609a41_amd64 as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/hive-rhel9@sha256:b0abd996b07c44e9e7604569f758879a5c38b9fa85e3b0b39c7e4d6b45097e8a_arm64 as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:76cbe8c79a30c24f36ffaaa03561a0e40a2f6c93881d119f82f6f344c0ee61cf_amd64 as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1190fb7cfb27d8d6cf7b1deda402a07ceb2e6406d6157dab93b5c3bbde48aaa5_amd64 as a component of multicluster engine for Kubernetes 2.6 | registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1190fb7cfb27d8d6cf7b1deda402a07ceb2e6406d6157dab93b5c3bbde48aaa5_amd64, registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1190fb7cfb27d8d6cf7b1deda402a07ceb2e6406d6157dab93b5c3bbde48aaa5_amd64 |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6d5b0771a8af890087ab0ff850f31c386d2fe537f2436ca45b330b4d06d624ac_s390x as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:c66c60e6f6d92086ba812398d66cec025a71914402c7f6e9b7cd7c6ac1d22648_ppc64le as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d0fab77c60c8b0915844238a45af8467fd70ca3b61a5d7d1f6239dc2dc7ddf81_arm64 as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:2cc6f284e9f283da1a416bc2851e6e2ff89649d1357f6f3c728382de67dd6e82_amd64 as a component of multicluster engine for Kubernetes 2.6 | * |
| Red Hat | registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:9e35ad6d5753051e8468f7a91ee993453e413666d108eca651c2a4861c84a0e1_s390x as a component of multicluster engine for Kubernetes 2.6 | registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:9e35ad6d5753051e8468f7a91ee993453e413666d108eca651c2a4861c84a0e1_s390x, * |
| Red Hat | registry.redhat.io/multicluster-engine/placement-rhel9@sha256:ba619fd1055ec06103c2e32806b2c8b3fd13e8a1388f90c70aec862c5d153c8f_ppc64le as a component of multicluster engine for Kubernetes 2.6 | registry.redhat.io/multicluster-engine/placement-rhel9@sha256:ba619fd1055ec06103c2e32806b2c8b3fd13e8a1388f90c70aec862c5d153c8f_ppc64le, * |
…and 196 more
Timeline
- Dec 17, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:23528 advisory
- https://access.redhat.com/security/cve/CVE-2022-21698 advisory
- https://access.redhat.com/security/cve/CVE-2023-44487 advisory
- https://access.redhat.com/security/cve/CVE-2025-7195 advisory
- https://access.redhat.com/security/cve/CVE-2025-7783 advisory
- https://access.redhat.com/security/cve/CVE-2025-9287 advisory
- https://access.redhat.com/security/cve/CVE-2025-9288 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23528.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2045880 issue
- https://www.cve.org/CVERecord?id=CVE-2022-21698 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-21698 advisory
- https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803 issue
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-44487 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487 advisory
- https://github.com/dotnet/announcements/issues/277 advisory
- https://pkg.go.dev/vuln/GO-2023-2102 advisory
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 advisory
…and 20 more