VDB
RHSA-2025%3A22014
RHSA-2025%3A22014
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. This issue could be exploied by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6e5e4831bc7c1de6b238a5a72820180265ea5f4d4589cbad0244d211078d75be_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6e5e4831bc7c1de6b238a5a72820180265ea5f4d4589cbad0244d211078d75be_arm64, * |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:e716a4a86a9a8d3065c8de19be72dd2cf63e171a404231052287022f535ef91e_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:e716a4a86a9a8d3065c8de19be72dd2cf63e171a404231052287022f535ef91e_amd64, * |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:e716a4a86a9a8d3065c8de19be72dd2cf63e171a404231052287022f535ef91e_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.15 | *, registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:e716a4a86a9a8d3065c8de19be72dd2cf63e171a404231052287022f535ef91e_amd64, registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:e716a4a86a9a8d3065c8de19be72dd2cf63e171a404231052287022f535ef91e_amd64 |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2c54470f4b9e71f11a22259db0026626459cfd75fa1f6ad96af8bd3064bf4e1e_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2c54470f4b9e71f11a22259db0026626459cfd75fa1f6ad96af8bd3064bf4e1e_ppc64le, registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2c54470f4b9e71f11a22259db0026626459cfd75fa1f6ad96af8bd3064bf4e1e_ppc64le, registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2c54470f4b9e71f11a22259db0026626459cfd75fa1f6ad96af8bd3064bf4e1e_ppc64le |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:d51c7a02f1f322a651fb258e02e3b4cb99b704f5eb7efce4b691f2ae75a20bc6_s390x as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:d51c7a02f1f322a651fb258e02e3b4cb99b704f5eb7efce4b691f2ae75a20bc6_s390x, registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:d51c7a02f1f322a651fb258e02e3b4cb99b704f5eb7efce4b691f2ae75a20bc6_s390x, registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:d51c7a02f1f322a651fb258e02e3b4cb99b704f5eb7efce4b691f2ae75a20bc6_s390x |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:debdf90d1e44dbd41b8df3f1bd45369ff83376d0221d80c2f236b1b1e498a5ef_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:debdf90d1e44dbd41b8df3f1bd45369ff83376d0221d80c2f236b1b1e498a5ef_ppc64le, * |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:eb81f9a7303eca0ba0d5fccb2682165c4427fccc3ecc7fbdd2056930d39423ca_s390x as a component of cert-manager operator for Red Hat OpenShift 1.15 | *, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:eb81f9a7303eca0ba0d5fccb2682165c4427fccc3ecc7fbdd2056930d39423ca_s390x |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2c54470f4b9e71f11a22259db0026626459cfd75fa1f6ad96af8bd3064bf4e1e_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2c54470f4b9e71f11a22259db0026626459cfd75fa1f6ad96af8bd3064bf4e1e_ppc64le, registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2c54470f4b9e71f11a22259db0026626459cfd75fa1f6ad96af8bd3064bf4e1e_ppc64le |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:eb81f9a7303eca0ba0d5fccb2682165c4427fccc3ecc7fbdd2056930d39423ca_s390x as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:eb81f9a7303eca0ba0d5fccb2682165c4427fccc3ecc7fbdd2056930d39423ca_s390x, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:eb81f9a7303eca0ba0d5fccb2682165c4427fccc3ecc7fbdd2056930d39423ca_s390x, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:eb81f9a7303eca0ba0d5fccb2682165c4427fccc3ecc7fbdd2056930d39423ca_s390x |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c09abae05168529eca3e247c604760e6912b53ece38c4266978a43405363a97c_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c09abae05168529eca3e247c604760e6912b53ece38c4266978a43405363a97c_amd64, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c09abae05168529eca3e247c604760e6912b53ece38c4266978a43405363a97c_amd64, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c09abae05168529eca3e247c604760e6912b53ece38c4266978a43405363a97c_amd64 |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:debdf90d1e44dbd41b8df3f1bd45369ff83376d0221d80c2f236b1b1e498a5ef_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.15 | *, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:debdf90d1e44dbd41b8df3f1bd45369ff83376d0221d80c2f236b1b1e498a5ef_ppc64le, * |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c09abae05168529eca3e247c604760e6912b53ece38c4266978a43405363a97c_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.15 | *, * |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:2ed56c5467b3eed15cf5f940a552d23e8cfee653df64708077d8edbe17f7baaf_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:2ed56c5467b3eed15cf5f940a552d23e8cfee653df64708077d8edbe17f7baaf_arm64, * |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:d51c7a02f1f322a651fb258e02e3b4cb99b704f5eb7efce4b691f2ae75a20bc6_s390x as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:d51c7a02f1f322a651fb258e02e3b4cb99b704f5eb7efce4b691f2ae75a20bc6_s390x, registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:d51c7a02f1f322a651fb258e02e3b4cb99b704f5eb7efce4b691f2ae75a20bc6_s390x |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6e5e4831bc7c1de6b238a5a72820180265ea5f4d4589cbad0244d211078d75be_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.15 | registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6e5e4831bc7c1de6b238a5a72820180265ea5f4d4589cbad0244d211078d75be_arm64, *, registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6e5e4831bc7c1de6b238a5a72820180265ea5f4d4589cbad0244d211078d75be_arm64 |
| Red Hat | registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:2ed56c5467b3eed15cf5f940a552d23e8cfee653df64708077d8edbe17f7baaf_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.15 | *, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:2ed56c5467b3eed15cf5f940a552d23e8cfee653df64708077d8edbe17f7baaf_arm64, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:2ed56c5467b3eed15cf5f940a552d23e8cfee653df64708077d8edbe17f7baaf_arm64 |
Timeline
- Nov 25, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- May 11, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:22014 advisory
- https://access.redhat.com/security/cve/CVE-2025-27144 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22014.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2347423 issue
- https://www.cve.org/CVERecord?id=CVE-2025-27144 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-27144 advisory
- https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22 advisory
- https://github.com/go-jose/go-jose/releases/tag/v4.0.5 advisory
- https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78 advisory