Skip to content
Fencer Vulns
medium 6.6

CVE-2025-27144 json

Go JOSE's Parsing Vulnerable to Denial of Service

published 2025-02-24 20 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-4268 , GHSA-c6gw-w398-hv78 , GO-2025-3485

cvss
6.6
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.

Patch / fix

  • go github.com/go-jose/go-jose/v4 4.0.5
  • go github.com/go-jose/go-jose/v3 3.0.4
  • go github.com/go-jose/go-jose 3.0.4
  • go-jose_project go-jose 4.0.5
  • golang-github-go-jose-go-jose Debian 14, Debian 13 4.0.5-1

debian advisories DEBIAN-CVE-2025-27144

  • osbuild-composer RHEL 9 132.2-3.el9_6
  • osbuild-composer-core RHEL 9 132.2-3.el9_6
  • osbuild-composer-worker RHEL 9 132.2-3.el9_6
  • osbuild-composer RHEL 10.0 134.1-3.el10_0
  • osbuild-composer-core RHEL 10.0 134.1-3.el10_0
  • osbuild-composer-worker RHEL 10.0 134.1-3.el10_0
  • opentelemetry-collector RHEL 10.0 0.107.0-9.el10_0
  • skopeo RHEL 10.0 2:1.18.1-1.el10_0

red hat advisories RHSA-2025:19594RHSA-2025:19566RHSA-2025:7479RHSA-2025:7467RHSA-2025:7462RHSA-2025:7459

  • podman Linux Micro 6.0 4.9.5-12.1
  • buildah SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 1.35.5-150500.3.62.1
  • buildah SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 1.35.5-150400.3.68.1
  • vexctl openSUSE Leap 15.6 0.4.1+git78.f951e3a-150000.1.11.1
  • apptainer SLES 15 SP6-LTSS, SLE Module for HPC 15 SP7, openSUSE Leap 15.6 1.4.5-150600.4.12.1
  • squashfuse SLES 15 SP6-LTSS, SLE Module for HPC 15 SP7, openSUSE Leap 15.6 0.5.0-150600.3.2.1
  • podman Linux Micro 6.0 4.9.5-8.1
  • podman SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Module for Containers 15 SP7 +5 more 4.9.5-150500.3.43.2

suse advisories SUSE-SU-2026:22516-1SUSE-SU-2026:2733-1SUSE-SU-2026:2706-1SUSE-SU-2026:0592-1SUSE-SU-2026:0439-1SUSE-SU-2025:20869-1

  • kubectl-retina openSUSE Tumbleweed 1.3.1-1.1
  • vexctl openSUSE Leap 16.0 0.4.4+git20.5d61136-160000.1.1
  • gh openSUSE Leap 16.0 2.96.0-bp160.1.1
  • vexctl openSUSE Tumbleweed 0.4.1+git78.f951e3a-1.1
  • traefik openSUSE Tumbleweed 3.4.3-1.1
  • traefik2 openSUSE Tumbleweed 2.11.26-1.1
  • velociraptor openSUSE Tumbleweed 0.7.0.4.git163.87ee3570-1.1
  • gh openSUSE Tumbleweed 2.73.0-1.1

opensuse advisories openSUSE-SU-2026:12297-1openSUSE-SU-2026:21481-1openSUSE-SU-2026:21310-1openSUSE-SU-2026:10230-1openSUSE-SU-2025:15304-1openSUSE-SU-2025:15305-1

  • osbuild-composer AlmaLinux 10 134.1-3.el10_0.alma.1
  • osbuild-composer-core AlmaLinux 10 134.1-3.el10_0.alma.1
  • osbuild-composer-worker AlmaLinux 10 134.1-3.el10_0.alma.1
  • buildah AlmaLinux 9 2:1.39.4-1.el9_6
  • buildah-tests AlmaLinux 9 2:1.39.4-1.el9_6
  • skopeo AlmaLinux 9 2:1.18.1-1.el9_6
  • skopeo-tests AlmaLinux 9 2:1.18.1-1.el9_6
  • buildah AlmaLinux 10 2:1.39.4-1.el10_0

almalinux advisories ALSA-2025:19566ALSA-2025:7389ALSA-2025:7397ALSA-2025:7459ALSA-2025:7462ALSA-2025:7467

  • buildah Rocky Linux 9 2:1.39.4-1.el9_6
  • podman Rocky Linux 9 5:5.4.0-9.el9_6
  • skopeo Rocky Linux 9 2:1.18.1-1.el9_6
  • buildah Rocky Linux 10 2:1.39.4-1.el10_0
  • podman Rocky Linux 10 6:5.4.0-9.el10_0
  • skopeo Rocky Linux 10 2:1.18.1-1.el10_0
  • opentelemetry-collector Rocky Linux 10 0.107.0-9.el10_0

rocky linux advisories RLSA-2025:7389RLSA-2025:7391RLSA-2025:7397RLSA-2025:7459RLSA-2025:7462RLSA-2025:7467

  • skopeo Azure Linux 3.0 1.14.4-4
  • influxdb CBL-Mariner 2.0 2.6.1-21
  • dcos-cli Azure Linux 3.0 1.2.0-17
  • ig Azure Linux 3.0 0.37.0-3
  • kube-vip-cloud-provider CBL-Mariner 2.0 0.0.2-20
  • buildah Azure Linux 3.0 1.41.4-2
  • kubernetes Azure Linux 3.0 1.30.10-3
  • moby-containerd-cc Azure Linux 3.0 1.7.7-9

azure linux advisories AZL-57096AZL-57099AZL-57102AZL-57105AZL-57108AZL-57114

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-27144 updated cvss 7.5

go-jose: Go JOSE's Parsing Vulnerable to Denial of Service

  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8 Red Hat Multicluster Engine for Kubernetes multicluster-engine/hypershift-cli-rhel9, multicluster-engine/assisted-installer-rhel8, multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/hypershift-addon-rhel9-operator, +1 more
    affected: workaround, no fix available “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.”
  • Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: workaround, no fix planned “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.”
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-must-gather-rhel9 Red Hat 3scale API Management Platform 2 rhcl-1/authorino-rhel9 Red Hat Connectivity Link 1 rhcl-1/authorino-rhel9 Red Hat Enterprise Linux 10 rhel10-beta/bootc-image-builder Red Hat OpenShift Container Platform 4 cri-o, openshift-clients, openshift4/ose-deployer, openshift4/ose-cli-artifacts, openshift-clients-redistributable Red Hat OpenShift on AWS rosa
    affected: workaround, no fix available “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.”
  • Red Hat cert-manager operator for Red Hat OpenShift 1.15 cert-manager
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:22014
  • Red Hat CNV 4.17 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.17.5-2, container-native-virtualization/pr-helper-rhel9 v4.17.5-2, container-native-virtualization/aaq-server-rhel9 v4.17.5-2, container-native-virtualization/wasp-agent-rhel9 v4.17.5-1, container-native-virtualization/kubemacpool-rhel9 v4.17.5-1, container-native-virtualization/aaq-operator-rhel9 v4.17.5-2, +46 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHEA-2025:2194
  • Red Hat CNV 4.18 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.18.1-3, container-native-virtualization/pr-helper-rhel9 v4.18.1-4, container-native-virtualization/aaq-server-rhel9 v4.18.1-2, container-native-virtualization/virtio-win-rhel9 v4.18.1-2, container-native-virtualization/wasp-agent-rhel9 v4.18.1-3, container-native-virtualization/kubemacpool-rhel9 v4.18.1-2, +48 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHEA-2025:3152
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift 2.15 custom-metrics-autoscaler 2.15.1-1742296747
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3501
  • Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-mustgather-rhel9 1.4.5-34
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:11396
show 25 more
  • Red Hat Quay v3 quay/quay-rhel8 v3.9.12-7, quay/clair-rhel8 v3.9.12-2, quay/quay-rhel8 v3.10.11-5, quay/quay-rhel8 v3.11.11-5, quay/clair-rhel8 v3.10.11-1, quay/clair-rhel8 v3.11.11-1, +24 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHBA-2025:8687
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 rhacm2
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:22684
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1768088963
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2026:0627
  • Red Hat Enterprise Linux AppStream (v. 9) podman 5.4.0-9.el9_6, skopeo 1.18.1-1.el9_6, buildah 1.39.4-1.el9_6, podman-tests 5.4.0-9.el9_6, podman-docker 5.4.0-9.el9_6, podman-remote 5.4.0-9.el9_6, +8 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3335
  • Red Hat Enterprise Linux AppStream (v. 10) podman 5.4.0-9.el10_0, skopeo 1.18.1-1.el10_0, buildah 1.39.4-1.el10_0, podman-docker 5.4.0-9.el10_0, podman-remote 5.4.0-9.el10_0, skopeo-tests 1.18.1-1.el10_0, +5 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:7459
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) opentelemetry-collector 0.107.0-7.el9_4
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3593
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests 5.4.0-9.el10_0
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:7462
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-aws-pod-identity-webhook-rhel9 v4.16.0-202503170806.p0.g459c531.assembly.stream.el9, openshift4/ose-cloud-credential-rhel9-operator v4.16.0-202503191806.p0.gaa7ad99.assembly.stream.el9, openshift4/ose-azure-workload-identity-webhook-rhel9 v4.16.0-202503210503.p0.ga754496.assembly.stream.el9
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3301
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202505062152-0, podman 5.2.2-4.rhaos4.17.el8, podman 5.2.2-4.rhaos4.17.el9, skopeo 1.16.1-1.rhaos4.17.el8, skopeo 1.16.1-1.rhaos4.17.el9, podman-tests 5.2.2-4.rhaos4.17.el8, +42 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3061
  • Red Hat OpenShift Container Platform 4.18 podman 5.2.2-6.rhaos4.18.el9, skopeo 1.16.1-1.rhaos4.18.el9, podman-tests 5.2.2-6.rhaos4.18.el9, podman-docker 5.2.2-6.rhaos4.18.el9, podman-remote 5.2.2-6.rhaos4.18.el9, skopeo-tests 1.16.1-1.rhaos4.18.el9, +11 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:4427
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-cli-rhel9 v4.19.0-202505210330.p0.g8f1c8b5.assembly.stream.el9
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2024:11038
  • Red Hat OpenShift distributed tracing 3.5.3 rhosdt rhosdt-3.5-1744103234
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3743
  • Red Hat OpenShift distributed tracing 3.6.0 rhosdt rhosdt-3.6-1749565051
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:9167
  • Red Hat OpenShift GitOps 1.15 openshift-gitops-1/dex-rhel8 v1.15.2-4, openshift-gitops-1/argocd-rhel8 v1.15.2-4, openshift-gitops-1/argocd-rhel9 v1.15.2-1, openshift-gitops-1/gitops-rhel8 v1.15.2-4, openshift-gitops-1/must-gather-rhel8 v1.15.2-4, openshift-gitops-1/argo-rollouts-rhel8 v1.15.2-4, +4 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:7753
  • Red Hat OpenShift Pipelines 1.15 openshift-pipelines 1772609258
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2026:3718
  • Red Hat Trusted Artifact Signer 1.1 rhtas 1.1.2-1743007499, rhtas 1.1.2-1743008763
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3820
  • Red Hat RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.6.4-7, advanced-cluster-security/rhacs-roxctl-rhel8 4.6.4-3, advanced-cluster-security/rhacs-scanner-rhel8 4.6.4-4, advanced-cluster-security/rhacs-rhel8-operator 4.6.4-4, advanced-cluster-security/rhacs-collector-rhel8 4.6.4-3, advanced-cluster-security/rhacs-operator-bundle 4.6.4-7, +7 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3439
  • Red Hat RHACS 4.7 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.7.1-5, advanced-cluster-security/rhacs-roxctl-rhel8 4.7.1-2, advanced-cluster-security/rhacs-scanner-rhel8 4.7.1-2, advanced-cluster-security/rhacs-rhel8-operator 4.7.1-2, advanced-cluster-security/rhacs-collector-rhel8 4.7.1-2, advanced-cluster-security/rhacs-operator-bundle 4.7.1-3, +6 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3438
  • Red Hat RHODF 4.17 for RHEL 9 odf4/odf-cli-rhel9 v4.17.7-2, odf4/mcg-rhel9-operator v4.17.7-2, odf4/ocs-rhel9-operator v4.17.7-1, odf4/rook-ceph-rhel9-operator v4.17.7-2, odf4/ocs-metrics-exporter-rhel9 v4.17.7-1, odf4/odf-multicluster-rhel9-operator v4.17.7-1
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:8059
  • Red Hat RHODF 4.18 for RHEL 9 odf4/odf-cli-rhel9 v4.18.2-5, odf4/mcg-rhel9-operator v4.18.2-5, odf4/ocs-rhel9-operator v4.18.2-6, odf4/rook-ceph-rhel9-operator v4.18.2-9, odf4/ocs-metrics-exporter-rhel9 v4.18.2-8, odf4/odf-multicluster-rhel9-operator v4.18.2-6
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:4511
  • Red Hat RHOL 5.9 for RHEL 9 openshift-logging/fluentd-rhel9 v5.9.13-5, openshift-logging/vector-rhel9 v0.34.1-37, openshift-logging/eventrouter-rhel9 v0.4.0-363, openshift-logging/logging-loki-rhel9 v3.3.2-36, openshift-logging/loki-rhel9-operator v5.9.13-9, openshift-logging/opa-openshift-rhel9 v0.1.0-383, +6 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3906
  • Red Hat RHOL 6.0 for RHEL 9 openshift-logging/vector-rhel9 v0.37.1-35, openshift-logging/logging-loki-rhel9 v3.4.2-7, openshift-logging/eventrouter-rhel9 v0.4.0-357, openshift-logging/loki-rhel9-operator v6.0.6-6, openshift-logging/loki-operator-bundle v6.0.6-10, openshift-logging/opa-openshift-rhel9 v0.1.0-370, +4 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3132
  • Red Hat RHOL 6.1 for RHEL 9 openshift-logging/vector-rhel9 v0.37.1-34, openshift-logging/logging-loki-rhel9 v3.4.2-6, openshift-logging/eventrouter-rhel9 v0.4.0-356, openshift-logging/loki-rhel9-operator v6.1.4-7, openshift-logging/loki-operator-bundle v6.1.4-13, openshift-logging/opa-openshift-rhel9 v0.1.0-369, +4 more
    fixed: vendor fix “As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.” RHSA-2025:3131
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8
    not affected: vulnerable code not in execute path
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift 2.15 custom-metrics-autoscaler 2.15.1-1742296189, custom-metrics-autoscaler 2.15.1-1742297180, custom-metrics-autoscaler 2.15.1-1742297344, custom-metrics-autoscaler 2.15.1-1742311148
    not affected: vulnerable code not present

15 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
CNA 4.0 6.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
go github.com/go-jose/go-jose/v4
<4.0.5
4.0.5
go github.com/go-jose/go-jose/v3
<3.0.4
3.0.4
go github.com/go-jose/go-jose
<3.0.4
all versions
3.0.4
go github.com/square/go-jose
all versions
 no fix listed

Affected products

  • go-jose go-jose

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.