VDB
RHSA-2025%3A12323
RHSA-2025%3A12323
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:e7b274b793f3e84b191392a1145926c1fe5f679bf10e0640ce3c7f47aac025ea_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:e7b274b793f3e84b191392a1145926c1fe5f679bf10e0640ce3c7f47aac025ea_amd64, *, * |
| Red Hat | openshift4/ose-cluster-api-rhel8@sha256:aaf6701f35d57dbe7ea88c1f4f8eda6d34f52d448bbfedf1039b56bc11b1be05_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-cluster-api-rhel8@sha256:aaf6701f35d57dbe7ea88c1f4f8eda6d34f52d448bbfedf1039b56bc11b1be05_amd64, openshift4/ose-cluster-api-rhel8@sha256:aaf6701f35d57dbe7ea88c1f4f8eda6d34f52d448bbfedf1039b56bc11b1be05_amd64, * |
| Red Hat | openshift4/ose-machine-api-provider-azure-rhel8@sha256:34c204ade60a71453befb982b69a308191115eacca2ff08b17193962ddeab973_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-machine-api-provider-azure-rhel8@sha256:34c204ade60a71453befb982b69a308191115eacca2ff08b17193962ddeab973_amd64, openshift4/ose-machine-api-provider-azure-rhel8@sha256:34c204ade60a71453befb982b69a308191115eacca2ff08b17193962ddeab973_amd64, openshift4/ose-machine-api-provider-azure-rhel8@sha256:34c204ade60a71453befb982b69a308191115eacca2ff08b17193962ddeab973_amd64 |
| Red Hat | openshift4/ose-kubevirt-cloud-controller-manager-rhel8@sha256:053449bde42348819087c4b9a3eea2a3c2c9ec77e68a9e1ec362bb29fe090357_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-kubevirt-cloud-controller-manager-rhel8@sha256:053449bde42348819087c4b9a3eea2a3c2c9ec77e68a9e1ec362bb29fe090357_amd64, openshift4/ose-kubevirt-cloud-controller-manager-rhel8@sha256:053449bde42348819087c4b9a3eea2a3c2c9ec77e68a9e1ec362bb29fe090357_amd64, openshift4/ose-kubevirt-cloud-controller-manager-rhel8@sha256:053449bde42348819087c4b9a3eea2a3c2c9ec77e68a9e1ec362bb29fe090357_amd64 |
| Red Hat | openshift4/ose-csi-driver-manila-rhel8@sha256:19243ddcfefaf30ae1e2d6ea2e9d2e9f98e6832ed91acf6d1cf579e536db8798_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-csi-driver-manila-rhel8@sha256:19243ddcfefaf30ae1e2d6ea2e9d2e9f98e6832ed91acf6d1cf579e536db8798_amd64, openshift4/ose-csi-driver-manila-rhel8@sha256:19243ddcfefaf30ae1e2d6ea2e9d2e9f98e6832ed91acf6d1cf579e536db8798_amd64, openshift4/ose-csi-driver-manila-rhel8@sha256:19243ddcfefaf30ae1e2d6ea2e9d2e9f98e6832ed91acf6d1cf579e536db8798_amd64 |
| Red Hat | openshift4/ose-multus-admission-controller@sha256:830412b2f4e9b1bdc72c45df9ed32ff122f4432d682446e72beaa1f9d9ea959b_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-multus-admission-controller@sha256:830412b2f4e9b1bdc72c45df9ed32ff122f4432d682446e72beaa1f9d9ea959b_amd64, openshift4/ose-multus-admission-controller@sha256:830412b2f4e9b1bdc72c45df9ed32ff122f4432d682446e72beaa1f9d9ea959b_amd64, openshift4/ose-multus-admission-controller@sha256:830412b2f4e9b1bdc72c45df9ed32ff122f4432d682446e72beaa1f9d9ea959b_amd64 |
| Red Hat | openshift4/ose-telemeter@sha256:cb0a9a2e1360bc3c470d4493f3b8041c26af38200af7e93cc4d261a6f64314a3_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-telemeter@sha256:cb0a9a2e1360bc3c470d4493f3b8041c26af38200af7e93cc4d261a6f64314a3_amd64, openshift4/ose-telemeter@sha256:cb0a9a2e1360bc3c470d4493f3b8041c26af38200af7e93cc4d261a6f64314a3_amd64, * |
| Red Hat | openshift4/ose-powervs-block-csi-driver-operator-rhel8@sha256:b8f22a26062ea0cf4bde56a3124298420083dd3ce37944a7faf9d6511927c9ee_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-powervs-block-csi-driver-operator-rhel8@sha256:b8f22a26062ea0cf4bde56a3124298420083dd3ce37944a7faf9d6511927c9ee_amd64, *, * |
| Red Hat | openshift4/ovirt-csi-driver-rhel7@sha256:a838fb3d46bf2efd9db584ca0618bdd1c124f4e6002728cf541f168ad325ba0c_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ovirt-csi-driver-rhel7@sha256:a838fb3d46bf2efd9db584ca0618bdd1c124f4e6002728cf541f168ad325ba0c_amd64, *, openshift4/ovirt-csi-driver-rhel7@sha256:a838fb3d46bf2efd9db584ca0618bdd1c124f4e6002728cf541f168ad325ba0c_amd64 |
| Red Hat | openshift4/ose-vsphere-csi-driver-rhel8@sha256:00539ebebed396000b4fad666e59ea0c89951f31c23bc5e6ca49b4134c74065a_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, *, * |
| Red Hat | openshift4/ose-baremetal-runtimecfg-rhel8@sha256:097276f6f272bac22d956cf80c4c4a25cf1cb72830aca4c0cf644a094d8b2f75_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, openshift4/ose-baremetal-runtimecfg-rhel8@sha256:097276f6f272bac22d956cf80c4c4a25cf1cb72830aca4c0cf644a094d8b2f75_amd64, openshift4/ose-baremetal-runtimecfg-rhel8@sha256:097276f6f272bac22d956cf80c4c4a25cf1cb72830aca4c0cf644a094d8b2f75_amd64 |
| Red Hat | openshift4/ose-image-customization-controller-rhel8@sha256:aba52e92dc90437b8e5a39ebded7a8fadc9bf6d44bdf0e2143b439fd51f5cc3d_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-image-customization-controller-rhel8@sha256:aba52e92dc90437b8e5a39ebded7a8fadc9bf6d44bdf0e2143b439fd51f5cc3d_amd64, openshift4/ose-image-customization-controller-rhel8@sha256:aba52e92dc90437b8e5a39ebded7a8fadc9bf6d44bdf0e2143b439fd51f5cc3d_amd64, openshift4/ose-image-customization-controller-rhel8@sha256:aba52e92dc90437b8e5a39ebded7a8fadc9bf6d44bdf0e2143b439fd51f5cc3d_amd64 |
| Red Hat | openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:52172a1c14683a8e47361c6134e417beebe9741c0dc98be0c48d44793d0b26a3_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, *, openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:52172a1c14683a8e47361c6134e417beebe9741c0dc98be0c48d44793d0b26a3_amd64 |
| Red Hat | openshift4/ose-olm-rukpak-rhel8@sha256:e0edd1c94657126d2ba6e6c2fd152f4f0a05747a18605c56379ab5a66691f648_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-olm-rukpak-rhel8@sha256:e0edd1c94657126d2ba6e6c2fd152f4f0a05747a18605c56379ab5a66691f648_amd64, *, * |
| Red Hat | openshift4/ose-cluster-openshift-apiserver-operator@sha256:ae16c649b0278de831e429d2d8c8c14cdf445767f4a29ec894166f39d34270ff_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, openshift4/ose-cluster-openshift-apiserver-operator@sha256:ae16c649b0278de831e429d2d8c8c14cdf445767f4a29ec894166f39d34270ff_amd64, openshift4/ose-cluster-openshift-apiserver-operator@sha256:ae16c649b0278de831e429d2d8c8c14cdf445767f4a29ec894166f39d34270ff_amd64 |
| Red Hat | openshift4/ose-operator-registry@sha256:939f2ab58e286bbc35a76f8d6c116691582a65a5d46bcc80bbc5a7710722e7da_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, openshift4/ose-operator-registry@sha256:939f2ab58e286bbc35a76f8d6c116691582a65a5d46bcc80bbc5a7710722e7da_amd64, openshift4/ose-operator-registry@sha256:939f2ab58e286bbc35a76f8d6c116691582a65a5d46bcc80bbc5a7710722e7da_amd64 |
| Red Hat | openshift4/ose-csi-node-driver-registrar@sha256:13abaf9ea1d2738ef100b61bf7ff34283c21037e7e8087736f274f12f599df4a_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, openshift4/ose-csi-node-driver-registrar@sha256:13abaf9ea1d2738ef100b61bf7ff34283c21037e7e8087736f274f12f599df4a_amd64, openshift4/ose-csi-node-driver-registrar@sha256:13abaf9ea1d2738ef100b61bf7ff34283c21037e7e8087736f274f12f599df4a_amd64 |
| Red Hat | openshift4/ose-operator-lifecycle-manager@sha256:e976b2478361140e289cac4f3aed252cd68fe50142c2c34153fcde8205db1ee9_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-operator-lifecycle-manager@sha256:e976b2478361140e289cac4f3aed252cd68fe50142c2c34153fcde8205db1ee9_amd64, openshift4/ose-operator-lifecycle-manager@sha256:e976b2478361140e289cac4f3aed252cd68fe50142c2c34153fcde8205db1ee9_amd64, openshift4/ose-operator-lifecycle-manager@sha256:e976b2478361140e289cac4f3aed252cd68fe50142c2c34153fcde8205db1ee9_amd64 |
| Red Hat | openshift4/ose-azure-file-csi-driver-rhel8@sha256:0558073a7bcf14ab91d6523b4eb3d5474988875dac50638779debff66629a781_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-azure-file-csi-driver-rhel8@sha256:0558073a7bcf14ab91d6523b4eb3d5474988875dac50638779debff66629a781_amd64, *, openshift4/ose-azure-file-csi-driver-rhel8@sha256:0558073a7bcf14ab91d6523b4eb3d5474988875dac50638779debff66629a781_amd64 |
| Red Hat | openshift4/ose-cluster-kube-apiserver-operator@sha256:74d97f779703f4963e858547d308daaa0e87ccfd552085cdbfe0fd8323378040_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, *, * |
…and 365 more
Timeline
- Aug 7, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:12323 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2374692 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12323.json advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
- https://go.dev/cl/652155 advisory
- https://go.dev/issue/71490 advisory
- https://pkg.go.dev/vuln/GO-2025-3488 advisory
- https://access.redhat.com/security/cve/CVE-2025-32462 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-32462 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-32462 advisory
- https://www.stratascale.com/resource/cve-2025-32462-sudo-host-option-vulnerability/ advisory
- https://www.sudo.ws/security/advisories/host_any/ advisory