Skip to content
Fencer Vulns
high 7.5

CVE-2025-22868 json

Unexpected memory consumption during token parsing in golang.org/x/oauth2

published 2025-02-26 20 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-5341 , GHSA-6v2p-p543-phr9 , GO-2025-3488

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Patch / fix

  • go golang.org/x/oauth2 0.27.0
  • golang.org/x/oauth2 golang.org/x/oauth2/jws 0.27.0
  • golang-golang-x-oauth2 Debian 14, Debian 13 0.27.0-1

debian advisories DEBIAN-CVE-2025-22868

  • opentelemetry-collector RHEL 10.0 0.107.0-9.el10_0
  • opentelemetry-collector RHEL 9 0.107.0-8.el9_6
  • opentelemetry-collector RHEL 9 0.107.0-8.el9_5
  • opentelemetry-collector RHEL 9.4 EUS 0.107.0-7.el9_4

red hat advisories RHSA-2025:7479RHSA-2025:7407RHSA-2025:3593RHSA-2025:3335

  • google-osconfig-agent SLES for SAP applications 16.0, SLES 16.0 20260615.01-160000.1.2
  • google-guest-agent SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 20260529.00-150000.1.70.1
  • google-guest-agent SLE Module for Public Cloud 12 20260529.00-1.61.1
  • google-osconfig-agent Linux Micro 6.0 20260615.01-1.1
  • google-osconfig-agent Linux Micro 6.1 20260615.01-slfo.1.1_1.1
  • google-guest-agent SLES for SAP applications 16.0, SLES 16.0 20260430.00-160000.1.1
  • google-guest-agent Linux Micro 6.1 20260430.00-slfo.1.1_1.1
  • docker-stable SLE Module for Containers 15 SP7, openSUSE Leap 15.6 24.0.9_ce-150000.1.39.1

suse advisories SUSE-SU-2026:22558-1SUSE-SU-2026:2612-1SUSE-SU-2026:2581-1SUSE-SU-2026:22242-1SUSE-SU-2026:22249-1SUSE-SU-2026:22128-1

  • go-containerregistry openSUSE Leap 16.0 0.22.1-bp160.1.1
  • vexctl openSUSE Leap 16.0 0.4.4+git20.5d61136-160000.1.1
  • google-osconfig-agent openSUSE Leap 16.0 20260615.01-160000.1.2
  • cadvisor openSUSE Leap 16.0 0.60.3-bp160.1.1
  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1
  • google-guest-agent openSUSE Leap 16.0 20260430.00-160000.1.1
  • containerized-data-importer openSUSE Leap 16.0 1.64.0-160000.1.1
  • vexctl openSUSE Tumbleweed 0.4.1+git78.f951e3a-1.1

opensuse advisories openSUSE-SU-2026:22227-1openSUSE-SU-2026:21481-1openSUSE-SU-2026:21210-1openSUSE-SU-2026:21265-1openSUSE-SU-2026:11126-1openSUSE-SU-2026:20969-1

  • opentelemetry-collector Rocky Linux 10 0.107.0-9.el10_0

rocky linux advisories RLSA-2025:7479

  • kubernetes Azure Linux 3.0 1.30.10-3
  • azcopy Azure Linux 3.0 10.25.1-2
  • cert-manager Azure Linux 3.0 1.12.15-2
  • node-problem-detector Azure Linux 3.0 0.8.20-2
  • vitess Azure Linux 3.0 19.0.4-5
  • prometheus Azure Linux 3.0 2.45.4-10
  • influxdb Azure Linux 3.0 2.7.5-2
  • packer Azure Linux 3.0 1.9.5-6

azure linux advisories AZL-57306AZL-57309AZL-57312AZL-57315AZL-57324AZL-57335

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-22868 updated cvss 7.5

golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws

  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-rhel9, cert-manager/jetstack-cert-manager-acmesolver-rhel9
    affected: workaround, no fix available, no fix planned “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat Cryostat 3 cryostat-tech-preview/cryostat-storage-rhel8 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8
    affected: workaround, no fix available “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat Migration Toolkit for Applications 7 mta/mta-java-external-provider-rhel9, mta/mta-generic-external-provider-rhel9
    affected: workaround, no fix planned “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat OpenShift Developer Tools and Services odo, helm
    affected: workaround, no fix available, no fix planned “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: workaround, no fix available “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat OpenShift Serverless openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/func-utils-rhel8, openshift-serverless-1/serving-queue-rhel8, openshift-serverless-1/eventing-mtping-rhel8, openshift-serverless-1/serving-webhook-rhel8, openshift-serverless-1/eventing-webhook-rhel8, +20 more Red Hat OpenShift Service Mesh 2 openshift-service-mesh/proxyv2-rhel8, openshift-service-mesh/proxyv2-rhel9
    affected: workaround, no fix planned “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-must-gather-rhel9
    affected: workaround, no fix available “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-operator-bundle
    affected: workaround, no fix planned “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
show 22 more
  • Red Hat Advanced Cluster Management for Kubernetes 2 cluster-backup-operator, gatekeeper/gatekeeper-rhel9, gatekeeper/gatekeeper-rhel9-operator, multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9, +2 more
    affected: workaround, no fix available “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat Ansible Automation Platform 1.2 helm, openshift-clients Red Hat Ceph Storage 5 openshift4/grafana
    affected: workaround, no fix planned “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat Ceph Storage 6 pybind, grafana Red Hat Ceph Storage 9 grafana Red Hat Enterprise Linux 8 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json
    affected: workaround, no fix available “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat Enterprise Linux 9 ignition, ignition-edge, ignition-grub, ignition-validate
    affected: workaround, no fix planned “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat OpenShift Cluster Manager CLI ocm-cli-clients/ocm-cli-rhel9
    affected: workaround, no fix available “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat OpenShift Container Platform 4 ignition, ignition-validate, atomic-openshift-service-idler, ose-gcp-gcr-image-credential-provider, openshift4/ose-powervs-machine-controllers-rhel9, openshift4/bare-metal-event-relay-operator-bundle, +1 more
    affected: workaround, no fix available, no fix planned “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat Openshift Data Foundation 4 odf4/mcg-cli-rhel9 Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9, devspaces/devspaces-rhel8-operator
    affected: workaround, no fix available “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat OpenShift Virtualization 4 kubevirt, container-native-virtualization/virt-api-rhel9, container-native-virtualization/virt-handler-rhel9, container-native-virtualization/virt-launcher-rhel9, container-native-virtualization/virt-operator-rhel9, container-native-virtualization/virt-cdi-cloner-rhel9, +11 more
    affected: workaround, no fix planned “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat Storage 3 grafana, rhgs3/rhgs-gluster-block-prov-rhel7
    affected: workaround, no fix available “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.”
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/monitoring-console-plugin-rhel9 1782838476, cluster-observability-operator/logging-console-plugin-pf4-rhel9 1782839279, cluster-observability-operator/logging-console-plugin-pf5-rhel9 1782840539, cluster-observability-operator/monitoring-console-plugin-pf5-rhel9 1782844225, cluster-observability-operator/monitoring-console-plugin-pf6-rhel9 1782839658
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2026:34342
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.0.0-10, cryostat/cryostat-db-rhel9 4.0.0-10, cryostat/jfr-datasource-rhel9 4.0.0-10, cryostat/cryostat-reports-rhel9 4.0.0-10, cryostat/cryostat-storage-rhel9 4.0.0-10, cryostat/cryostat-operator-bundle 4.0.0-9, +5 more
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:3503
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift 2.15 custom-metrics-autoscaler 2.15.1-1742296189, custom-metrics-autoscaler 2.15.1-1742296747, custom-metrics-autoscaler 2.15.1-1742297180
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:3501
  • Red Hat gatekeeper 3.15 for RHEL 9 gatekeeper/gatekeeper-rhel9 v3.15.1-30, gatekeeper/gatekeeper-rhel9-operator v3.15.4-1, gatekeeper/gatekeeper-operator-bundle v3.15.4-1
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:3053
  • Red Hat gatekeeper 3.17 for RHEL 9 gatekeeper/gatekeeper-rhel9 v3.17.2-5, gatekeeper/gatekeeper-rhel9-operator v3.17.2-4, gatekeeper/gatekeeper-operator-bundle v3.17.2-2
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:3051
  • Red Hat Logging for Red Hat OpenShift 6.3 openshift-logging
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:23057
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-logging
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:23535
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.2 openshift-logging
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:23534
  • Red Hat multicluster engine for Kubernetes 2.4 for RHEL 8 multicluster-engine/hive-rhel8 v2.4.9-7, multicluster-engine/work-rhel8 v2.4.9-3, multicluster-engine/discovery-rhel8 v2.4.9-3, multicluster-engine/placement-rhel8 v2.4.9-5, multicluster-engine/cluster-api-rhel8 v2.4.9-3, multicluster-engine/console-mce-rhel8 v2.4.9-5, +30 more
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:8390
  • Red Hat multicluster engine for Kubernetes 2.5 for RHEL 8 multicluster-engine/hive-rhel8 v2.5.9-9, multicluster-engine/agent-service-rhel8 v2.5.9-8, multicluster-engine/assisted-installer-rhel8 v2.5.9-8, multicluster-engine/assisted-image-service-rhel8 v2.5.9-7, multicluster-engine/assisted-installer-agent-rhel8 v2.5.9-8, multicluster-engine/assisted-installer-reporter-rhel8 v2.5.9-8 Red Hat multicluster engine for Kubernetes 2.5 for RHEL 9 multicluster-engine/work-rhel9 v2.5.9-12, multicluster-engine/discovery-rhel9 v2.5.9-10, multicluster-engine/placement-rhel9 v2.5.9-12, multicluster-engine/cluster-api-rhel9 v2.5.9-6, multicluster-engine/console-mce-rhel9 v2.5.9-11, multicluster-engine/must-gather-rhel9 v2.5.9-13, +26 more
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:4473
  • Red Hat multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-installer-rhel8 v2.6.7-11, multicluster-engine/assisted-service-8-rhel8 v2.6.7-16, multicluster-engine/assisted-image-service-rhel8 v2.6.7-11, multicluster-engine/assisted-installer-agent-rhel8 v2.6.7-11, multicluster-engine/assisted-installer-controller-rhel8 v2.6.7-11 Red Hat multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/hive-rhel9 v2.6.7-9, multicluster-engine/work-rhel9 v2.6.7-12, multicluster-engine/discovery-rhel9 v2.6.7-13, multicluster-engine/placement-rhel9 v2.6.7-13, multicluster-engine/cluster-api-rhel9 v2.6.7-7, multicluster-engine/console-mce-rhel9 v2.6.7-16, +24 more
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:4605
  • Red Hat multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8 v2.7.4-18 Red Hat multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/hive-rhel9 v2.7.4-8, multicluster-engine/work-rhel9 v2.7.4-15, multicluster-engine/discovery-rhel9 v2.7.4-14, multicluster-engine/placement-rhel9 v2.7.4-15, multicluster-engine/cluster-api-rhel9 v2.7.4-7, multicluster-engine/console-mce-rhel9 v2.7.4-20, +28 more
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:3987
  • Red Hat multicluster engine for Kubernetes 2.8 for RHEL 8 multicluster-engine/assisted-service-8-rhel8 v2.8.1-4 Red Hat multicluster engine for Kubernetes 2.8 for RHEL 9 multicluster-engine/hive-rhel9 v2.8.1-2, multicluster-engine/work-rhel9 v2.8.1-4, multicluster-engine/discovery-rhel9 v2.8.1-4, multicluster-engine/placement-rhel9 v2.8.1-4, multicluster-engine/console-mce-rhel9 v2.8.1-6, multicluster-engine/must-gather-rhel9 v2.8.1-4, +27 more
    fixed: vendor fix “To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.” RHSA-2025:3720

40 more fixed, 45 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go golang.org/x/oauth2
<0.27.0
0.27.0

Affected products

  • golang.org/x/oauth2 golang.org/x/oauth2/jws

Classification

Weakness
  • CWE-1286 Improper Validation of Syntactic Correctness of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.