VDB

RHSA-2025%3A11573

RHSA-2025%3A11573 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatmulticluster-engine/assisted-installer-rhel9@sha256:d12a3856e26fc007e9651a34a45fb7e3aebe6bd5ce602e1fb9f76630a2401649_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, multicluster-engine/assisted-installer-rhel9@sha256:d12a3856e26fc007e9651a34a45fb7e3aebe6bd5ce602e1fb9f76630a2401649_ppc64le, multicluster-engine/assisted-installer-rhel9@sha256:d12a3856e26fc007e9651a34a45fb7e3aebe6bd5ce602e1fb9f76630a2401649_ppc64le
Red Hatmulticluster-engine/cluster-api-rhel9@sha256:f2b5025037f316d5ca14653df3238c0b8669ad061f0067705c0c3fd83aa85b6d_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, *, multicluster-engine/cluster-api-rhel9@sha256:f2b5025037f316d5ca14653df3238c0b8669ad061f0067705c0c3fd83aa85b6d_arm64
Red Hatmulticluster-engine/provider-credential-controller-rhel9@sha256:8eccedec0ab215e46de4ec9f31092beeab71d472b9f921f62c50b4215ff52963_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, *, multicluster-engine/provider-credential-controller-rhel9@sha256:8eccedec0ab215e46de4ec9f31092beeab71d472b9f921f62c50b4215ff52963_amd64
Red Hatmulticluster-engine/registration-operator-rhel9@sha256:96cc699317c26c6c24e45ba62081bde86ecf4ac16f7878e4fff2580655f196b0_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/registration-operator-rhel9@sha256:96cc699317c26c6c24e45ba62081bde86ecf4ac16f7878e4fff2580655f196b0_amd64, *, multicluster-engine/registration-operator-rhel9@sha256:96cc699317c26c6c24e45ba62081bde86ecf4ac16f7878e4fff2580655f196b0_amd64
Red Hatmulticluster-engine/hypershift-rhel9-operator@sha256:b1bbadc0dcb343d2b434cd9d5b1b1480169cf52e590c20d8681cbf1f557ed0d5_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/hypershift-rhel9-operator@sha256:b1bbadc0dcb343d2b434cd9d5b1b1480169cf52e590c20d8681cbf1f557ed0d5_amd64, multicluster-engine/hypershift-rhel9-operator@sha256:b1bbadc0dcb343d2b434cd9d5b1b1480169cf52e590c20d8681cbf1f557ed0d5_amd64, multicluster-engine/hypershift-rhel9-operator@sha256:b1bbadc0dcb343d2b434cd9d5b1b1480169cf52e590c20d8681cbf1f557ed0d5_amd64
Red Hatmulticluster-engine/hypershift-cli-rhel9@sha256:be7777cf69cc928b5db4e6419940a4d44aec9d28c595f1bf2b5cce4ef9b1f130_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, multicluster-engine/hypershift-cli-rhel9@sha256:be7777cf69cc928b5db4e6419940a4d44aec9d28c595f1bf2b5cce4ef9b1f130_s390x, multicluster-engine/hypershift-cli-rhel9@sha256:be7777cf69cc928b5db4e6419940a4d44aec9d28c595f1bf2b5cce4ef9b1f130_s390x
Red Hatmulticluster-engine/discovery-rhel9@sha256:678a61e0e2f7983a775bb547d7890d604fdaf1e3d1b71c7ce7af5524acb66dcb_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/discovery-rhel9@sha256:678a61e0e2f7983a775bb547d7890d604fdaf1e3d1b71c7ce7af5524acb66dcb_arm64, *, multicluster-engine/discovery-rhel9@sha256:678a61e0e2f7983a775bb547d7890d604fdaf1e3d1b71c7ce7af5524acb66dcb_arm64
Red Hatmulticluster-engine/mce-operator-bundle@sha256:c69e27896d1acf18bff66affdb6cc88e06431ce41d04037e679e7e42cd0dea8e_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/mce-operator-bundle@sha256:c69e27896d1acf18bff66affdb6cc88e06431ce41d04037e679e7e42cd0dea8e_ppc64le, multicluster-engine/mce-operator-bundle@sha256:c69e27896d1acf18bff66affdb6cc88e06431ce41d04037e679e7e42cd0dea8e_ppc64le, multicluster-engine/mce-operator-bundle@sha256:c69e27896d1acf18bff66affdb6cc88e06431ce41d04037e679e7e42cd0dea8e_ppc64le
Red Hatmulticluster-engine/cluster-proxy-addon-rhel9@sha256:eddd2d30081d64752887daa9f764733dda96d8b1eefd6adb59d8e1190eea4344_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, multicluster-engine/cluster-proxy-addon-rhel9@sha256:eddd2d30081d64752887daa9f764733dda96d8b1eefd6adb59d8e1190eea4344_amd64, multicluster-engine/cluster-proxy-addon-rhel9@sha256:eddd2d30081d64752887daa9f764733dda96d8b1eefd6adb59d8e1190eea4344_amd64
Red Hatmulticluster-engine/assisted-installer-agent-rhel9@sha256:63691719781312223a4f54cb2fc0acece3ab666b9b3c555c28a24fa2ecb86c4c_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, multicluster-engine/assisted-installer-agent-rhel9@sha256:63691719781312223a4f54cb2fc0acece3ab666b9b3c555c28a24fa2ecb86c4c_arm64, multicluster-engine/assisted-installer-agent-rhel9@sha256:63691719781312223a4f54cb2fc0acece3ab666b9b3c555c28a24fa2ecb86c4c_arm64
Red Hatmulticluster-engine/hive-rhel9@sha256:49338b2f7285a6e5300d825b120f0dee83c3b36b2e2b6436635a483b57349d3b_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/hive-rhel9@sha256:49338b2f7285a6e5300d825b120f0dee83c3b36b2e2b6436635a483b57349d3b_arm64, multicluster-engine/hive-rhel9@sha256:49338b2f7285a6e5300d825b120f0dee83c3b36b2e2b6436635a483b57349d3b_arm64, multicluster-engine/hive-rhel9@sha256:49338b2f7285a6e5300d825b120f0dee83c3b36b2e2b6436635a483b57349d3b_arm64
Red Hatmulticluster-engine/registration-rhel9@sha256:41da70c77d168c56c69bb2d74e23c4551b66a782faecd647e68989e548b7408d_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/registration-rhel9@sha256:41da70c77d168c56c69bb2d74e23c4551b66a782faecd647e68989e548b7408d_s390x, *, multicluster-engine/registration-rhel9@sha256:41da70c77d168c56c69bb2d74e23c4551b66a782faecd647e68989e548b7408d_s390x
Red Hatmulticluster-engine/must-gather-rhel9@sha256:a83c008f055eddc6a96d3d7e3214f606d016d0172dc232816246b6f96b98ec0d_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/must-gather-rhel9@sha256:a83c008f055eddc6a96d3d7e3214f606d016d0172dc232816246b6f96b98ec0d_arm64, multicluster-engine/must-gather-rhel9@sha256:a83c008f055eddc6a96d3d7e3214f606d016d0172dc232816246b6f96b98ec0d_arm64, multicluster-engine/must-gather-rhel9@sha256:a83c008f055eddc6a96d3d7e3214f606d016d0172dc232816246b6f96b98ec0d_arm64
Red Hatmulticluster-engine/cluster-image-set-controller-rhel9@sha256:5b1b5cb938c1a2b023bf8fe90748488e7ff5de25fa3469d472619181f6531d6d_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/cluster-image-set-controller-rhel9@sha256:5b1b5cb938c1a2b023bf8fe90748488e7ff5de25fa3469d472619181f6531d6d_s390x, multicluster-engine/cluster-image-set-controller-rhel9@sha256:5b1b5cb938c1a2b023bf8fe90748488e7ff5de25fa3469d472619181f6531d6d_s390x, multicluster-engine/cluster-image-set-controller-rhel9@sha256:5b1b5cb938c1a2b023bf8fe90748488e7ff5de25fa3469d472619181f6531d6d_s390x
Red Hatmulticluster-engine/managed-serviceaccount-rhel9@sha256:76f910c8dc20c725df396a28bc36ea901d8e91c19cf73fb0500bb2f991f06c0e_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/managed-serviceaccount-rhel9@sha256:76f910c8dc20c725df396a28bc36ea901d8e91c19cf73fb0500bb2f991f06c0e_ppc64le, multicluster-engine/managed-serviceaccount-rhel9@sha256:76f910c8dc20c725df396a28bc36ea901d8e91c19cf73fb0500bb2f991f06c0e_ppc64le, *
Red Hatmulticluster-engine/registration-operator-rhel9@sha256:3642eb0c3735ff1db4cc58a86173207474085aae149e5d7c3a75b11eb385f6c7_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/registration-operator-rhel9@sha256:3642eb0c3735ff1db4cc58a86173207474085aae149e5d7c3a75b11eb385f6c7_ppc64le, *, multicluster-engine/registration-operator-rhel9@sha256:3642eb0c3735ff1db4cc58a86173207474085aae149e5d7c3a75b11eb385f6c7_ppc64le
Red Hatmulticluster-engine/cluster-image-set-controller-rhel9@sha256:a58939bcc937088bb807ff4de4ae18f29aa4a8d6edc1dab65cd5f49f8cb3c51e_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, *, *
Red Hatmulticluster-engine/multicloud-manager-rhel9@sha256:190cb345ecb51057d122699f935535f9abf0b9a6067eef67ea921b6ca6cd377e_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/multicloud-manager-rhel9@sha256:190cb345ecb51057d122699f935535f9abf0b9a6067eef67ea921b6ca6cd377e_ppc64le, multicluster-engine/multicloud-manager-rhel9@sha256:190cb345ecb51057d122699f935535f9abf0b9a6067eef67ea921b6ca6cd377e_ppc64le, multicluster-engine/multicloud-manager-rhel9@sha256:190cb345ecb51057d122699f935535f9abf0b9a6067eef67ea921b6ca6cd377e_ppc64le
Red Hatmulticluster-engine/hypershift-addon-rhel9-operator@sha256:c9b06d64482722d698b2822bce8cc78728bc3ae77ab0c60922f5399e93ecb0a0_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/hypershift-addon-rhel9-operator@sha256:c9b06d64482722d698b2822bce8cc78728bc3ae77ab0c60922f5399e93ecb0a0_ppc64le, *, multicluster-engine/hypershift-addon-rhel9-operator@sha256:c9b06d64482722d698b2822bce8cc78728bc3ae77ab0c60922f5399e93ecb0a0_ppc64le
Red Hatmulticluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:b0be7418c6307c9506ddd3b54a7d4d9d70f92d5fb5c0e9027737c748be87c16f_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:b0be7418c6307c9506ddd3b54a7d4d9d70f92d5fb5c0e9027737c748be87c16f_ppc64le, multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:b0be7418c6307c9506ddd3b54a7d4d9d70f92d5fb5c0e9027737c748be87c16f_ppc64le, multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:b0be7418c6307c9506ddd3b54a7d4d9d70f92d5fb5c0e9027737c748be87c16f_ppc64le

…and 258 more

Timeline

  • Jul 23, 2025 CVE Published
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Security Advisory
  • Apr 24, 2026 Security Advisory
  • May 16, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›