VDB
RHSA-2025%3A10781
RHSA-2025%3A10781
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-gcp-cloud-controller-manager-rhel9@sha256:64b057d5232ec057b63a7545f8501de6877d5610d109189da84c49ffcb0b8c03_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-gcp-cloud-controller-manager-rhel9@sha256:64b057d5232ec057b63a7545f8501de6877d5610d109189da84c49ffcb0b8c03_ppc64le, openshift4/ose-gcp-cloud-controller-manager-rhel9@sha256:64b057d5232ec057b63a7545f8501de6877d5610d109189da84c49ffcb0b8c03_ppc64le, openshift4/ose-gcp-cloud-controller-manager-rhel9@sha256:64b057d5232ec057b63a7545f8501de6877d5610d109189da84c49ffcb0b8c03_ppc64le |
| Red Hat | openshift4/ose-openstack-cloud-controller-manager-rhel9@sha256:7517067f6108e3b671ad04f3670974dc1a9e7814af6ee0cec0d85bc312ff80fb_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, *, openshift4/ose-openstack-cloud-controller-manager-rhel9@sha256:7517067f6108e3b671ad04f3670974dc1a9e7814af6ee0cec0d85bc312ff80fb_amd64 |
| Red Hat | openshift4/ose-installer-altinfra-rhel9@sha256:968a9858c90d134dda2270ba479993efeb3c6193bbe979f8db48eaa6f061eeb3_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, openshift4/ose-installer-altinfra-rhel9@sha256:968a9858c90d134dda2270ba479993efeb3c6193bbe979f8db48eaa6f061eeb3_arm64, openshift4/ose-installer-altinfra-rhel9@sha256:968a9858c90d134dda2270ba479993efeb3c6193bbe979f8db48eaa6f061eeb3_arm64 |
| Red Hat | openshift4/ose-ibmcloud-cluster-api-controllers-rhel9@sha256:26667b72d7196f9b8a28ce921df80a8c4ac4411562589a13a2ac0f8db2a22202_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-ibmcloud-cluster-api-controllers-rhel9@sha256:26667b72d7196f9b8a28ce921df80a8c4ac4411562589a13a2ac0f8db2a22202_ppc64le, openshift4/ose-ibmcloud-cluster-api-controllers-rhel9@sha256:26667b72d7196f9b8a28ce921df80a8c4ac4411562589a13a2ac0f8db2a22202_ppc64le, openshift4/ose-ibmcloud-cluster-api-controllers-rhel9@sha256:26667b72d7196f9b8a28ce921df80a8c4ac4411562589a13a2ac0f8db2a22202_ppc64le |
| Red Hat | openshift4/ose-prometheus-operator-admission-webhook-rhel9@sha256:6b19d0d26b0bc7b94dc5d4226102aa03f1dd733b29a721fae51ea4584b2802c8_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | *, openshift4/ose-prometheus-operator-admission-webhook-rhel9@sha256:6b19d0d26b0bc7b94dc5d4226102aa03f1dd733b29a721fae51ea4584b2802c8_ppc64le, openshift4/ose-prometheus-operator-admission-webhook-rhel9@sha256:6b19d0d26b0bc7b94dc5d4226102aa03f1dd733b29a721fae51ea4584b2802c8_ppc64le |
| Red Hat | openshift4/ose-machine-api-provider-gcp-rhel9@sha256:23c487fce4674601dbee28768e06815256c5b38d11abe221b8a263a991d98c55_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-machine-api-provider-gcp-rhel9@sha256:23c487fce4674601dbee28768e06815256c5b38d11abe221b8a263a991d98c55_amd64, openshift4/ose-machine-api-provider-gcp-rhel9@sha256:23c487fce4674601dbee28768e06815256c5b38d11abe221b8a263a991d98c55_amd64, openshift4/ose-machine-api-provider-gcp-rhel9@sha256:23c487fce4674601dbee28768e06815256c5b38d11abe221b8a263a991d98c55_amd64 |
| Red Hat | openshift4/ose-operator-marketplace-rhel9@sha256:7f5cb6819757367bae76ecaf399c17cf2e51b450ad9c3a386abf8438de07d040_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-operator-marketplace-rhel9@sha256:7f5cb6819757367bae76ecaf399c17cf2e51b450ad9c3a386abf8438de07d040_s390x, openshift4/ose-operator-marketplace-rhel9@sha256:7f5cb6819757367bae76ecaf399c17cf2e51b450ad9c3a386abf8438de07d040_s390x, * |
| Red Hat | openshift4/kubevirt-csi-driver-rhel9@sha256:75cd0e5329626cec752c09d2249f2aa55a7413588325bbfac9e9e5249a43a745_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/kubevirt-csi-driver-rhel9@sha256:75cd0e5329626cec752c09d2249f2aa55a7413588325bbfac9e9e5249a43a745_arm64, openshift4/kubevirt-csi-driver-rhel9@sha256:75cd0e5329626cec752c09d2249f2aa55a7413588325bbfac9e9e5249a43a745_arm64, openshift4/kubevirt-csi-driver-rhel9@sha256:75cd0e5329626cec752c09d2249f2aa55a7413588325bbfac9e9e5249a43a745_arm64 |
| Red Hat | openshift4/ose-cluster-policy-controller-rhel9@sha256:2b66b8de237d76caedf26809374ff06d0b82ab5d620e8a86efe98ebe832df5aa_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-cluster-policy-controller-rhel9@sha256:2b66b8de237d76caedf26809374ff06d0b82ab5d620e8a86efe98ebe832df5aa_arm64, openshift4/ose-cluster-policy-controller-rhel9@sha256:2b66b8de237d76caedf26809374ff06d0b82ab5d620e8a86efe98ebe832df5aa_arm64, * |
| Red Hat | rhcos@sha256:0fd390073eb6166f1c1636d15c245e3fea7b261d4c79b374f79e09b768ab210c_aarch64 as a component of Red Hat OpenShift Container Platform 4.16 | rhcos@sha256:0fd390073eb6166f1c1636d15c245e3fea7b261d4c79b374f79e09b768ab210c_aarch64, rhcos@sha256:0fd390073eb6166f1c1636d15c245e3fea7b261d4c79b374f79e09b768ab210c_aarch64, rhcos@sha256:0fd390073eb6166f1c1636d15c245e3fea7b261d4c79b374f79e09b768ab210c_aarch64 |
| Red Hat | openshift4/ose-cluster-image-registry-rhel9-operator@sha256:5c5f03fb1e9c8fda64b39d4acdc46e8fab2a26dcd8ca1df92ee680af0159f221_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, openshift4/ose-cluster-image-registry-rhel9-operator@sha256:5c5f03fb1e9c8fda64b39d4acdc46e8fab2a26dcd8ca1df92ee680af0159f221_arm64, openshift4/ose-cluster-image-registry-rhel9-operator@sha256:5c5f03fb1e9c8fda64b39d4acdc46e8fab2a26dcd8ca1df92ee680af0159f221_arm64 |
| Red Hat | openshift4/ose-configmap-reloader-rhel9@sha256:bddb86cf191d960d11597fcf946c35823e4da900e4caa56f952d8dd3ce98b7e3_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-configmap-reloader-rhel9@sha256:bddb86cf191d960d11597fcf946c35823e4da900e4caa56f952d8dd3ce98b7e3_amd64, *, openshift4/ose-configmap-reloader-rhel9@sha256:bddb86cf191d960d11597fcf946c35823e4da900e4caa56f952d8dd3ce98b7e3_amd64 |
| Red Hat | openshift4/ose-multus-cni-microshift-rhel9@sha256:86fa711dc0cd72dfe26485c8b6e0debba4275ead792fce3094826b29eee17b3d_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-multus-cni-microshift-rhel9@sha256:86fa711dc0cd72dfe26485c8b6e0debba4275ead792fce3094826b29eee17b3d_s390x, openshift4/ose-multus-cni-microshift-rhel9@sha256:86fa711dc0cd72dfe26485c8b6e0debba4275ead792fce3094826b29eee17b3d_s390x, openshift4/ose-multus-cni-microshift-rhel9@sha256:86fa711dc0cd72dfe26485c8b6e0debba4275ead792fce3094826b29eee17b3d_s390x |
| Red Hat | openshift4/ose-gcp-pd-csi-driver-rhel9@sha256:311aec7e1b15f56d5b5e69e2a14c966ff9a1dc483bda15e83b08d4fdb2bb0b2f_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-gcp-pd-csi-driver-rhel9@sha256:311aec7e1b15f56d5b5e69e2a14c966ff9a1dc483bda15e83b08d4fdb2bb0b2f_amd64, openshift4/ose-gcp-pd-csi-driver-rhel9@sha256:311aec7e1b15f56d5b5e69e2a14c966ff9a1dc483bda15e83b08d4fdb2bb0b2f_amd64, openshift4/ose-gcp-pd-csi-driver-rhel9@sha256:311aec7e1b15f56d5b5e69e2a14c966ff9a1dc483bda15e83b08d4fdb2bb0b2f_amd64 |
| Red Hat | openshift4/ose-prometheus-operator-admission-webhook-rhel9@sha256:68eead07832db6346f1934450500af6faa688276949e367471a0980bb369f7c9_s390x as a component of Red Hat OpenShift Container Platform 4.16 | *, openshift4/ose-prometheus-operator-admission-webhook-rhel9@sha256:68eead07832db6346f1934450500af6faa688276949e367471a0980bb369f7c9_s390x, * |
| Red Hat | openshift4/ose-cluster-machine-approver-rhel9@sha256:5ba84d2e134f27da2e9eddf085e4e2644a16084a6cc0f194c292dd4f148a7b1a_s390x as a component of Red Hat OpenShift Container Platform 4.16 | *, openshift4/ose-cluster-machine-approver-rhel9@sha256:5ba84d2e134f27da2e9eddf085e4e2644a16084a6cc0f194c292dd4f148a7b1a_s390x, openshift4/ose-cluster-machine-approver-rhel9@sha256:5ba84d2e134f27da2e9eddf085e4e2644a16084a6cc0f194c292dd4f148a7b1a_s390x |
| Red Hat | openshift4/ose-cluster-olm-rhel9-operator@sha256:0266df02d31d197df664c467a70acae91ac1212f0f9c1e8451ccaabf2c5ce0e9_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-cluster-olm-rhel9-operator@sha256:0266df02d31d197df664c467a70acae91ac1212f0f9c1e8451ccaabf2c5ce0e9_s390x, openshift4/ose-cluster-olm-rhel9-operator@sha256:0266df02d31d197df664c467a70acae91ac1212f0f9c1e8451ccaabf2c5ce0e9_s390x, openshift4/ose-cluster-olm-rhel9-operator@sha256:0266df02d31d197df664c467a70acae91ac1212f0f9c1e8451ccaabf2c5ce0e9_s390x |
| Red Hat | openshift4/ose-docker-registry-rhel9@sha256:bcd52d9bcaf160c44b262e5f21f412e10953f657b082be070de1946791a22b74_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, openshift4/ose-docker-registry-rhel9@sha256:bcd52d9bcaf160c44b262e5f21f412e10953f657b082be070de1946791a22b74_amd64, openshift4/ose-docker-registry-rhel9@sha256:bcd52d9bcaf160c44b262e5f21f412e10953f657b082be070de1946791a22b74_amd64 |
| Red Hat | openshift4/ose-prometheus-config-reloader-rhel9@sha256:b3b62ef3919753fa37062e031f17427adb0608736debeb6e5ddb3d6cba9876c1_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-prometheus-config-reloader-rhel9@sha256:b3b62ef3919753fa37062e031f17427adb0608736debeb6e5ddb3d6cba9876c1_arm64, openshift4/ose-prometheus-config-reloader-rhel9@sha256:b3b62ef3919753fa37062e031f17427adb0608736debeb6e5ddb3d6cba9876c1_arm64, * |
| Red Hat | openshift4/ose-multus-admission-controller-rhel9@sha256:888aa552b00b30b9b6b0da78913555cf32de870a8768be8918fbc2181992668f_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-multus-admission-controller-rhel9@sha256:888aa552b00b30b9b6b0da78913555cf32de870a8768be8918fbc2181992668f_amd64, *, openshift4/ose-multus-admission-controller-rhel9@sha256:888aa552b00b30b9b6b0da78913555cf32de870a8768be8918fbc2181992668f_amd64 |
…and 1309 more
Timeline
- Jul 17, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:10781 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2358493 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2374692 issue
- https://issues.redhat.com/browse/OCPBUGS-32934 advisory
- https://issues.redhat.com/browse/OCPBUGS-55807 advisory
- https://issues.redhat.com/browse/OCPBUGS-56424 advisory
- https://issues.redhat.com/browse/OCPBUGS-57396 advisory
- https://issues.redhat.com/browse/OCPBUGS-57460 advisory
- https://issues.redhat.com/browse/OCPBUGS-57498 advisory
- https://issues.redhat.com/browse/OCPBUGS-58054 advisory
- https://issues.redhat.com/browse/OCPBUGS-58188 advisory
- https://issues.redhat.com/browse/OCPBUGS-58270 advisory
- https://issues.redhat.com/browse/OCPBUGS-58432 advisory
- https://issues.redhat.com/browse/OCPBUGS-58505 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10781.json advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
…and 15 more