VDB
RHSA-2025%3A23534
RHSA-2025%3A23534
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:89e70e5e65669b1bdc846bdd51a731832b006e537dccdf9262df2105c72f9beb_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:89e70e5e65669b1bdc846bdd51a731832b006e537dccdf9262df2105c72f9beb_amd64, registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:89e70e5e65669b1bdc846bdd51a731832b006e537dccdf9262df2105c72f9beb_amd64, registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:89e70e5e65669b1bdc846bdd51a731832b006e537dccdf9262df2105c72f9beb_amd64 |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9d75a5f20193ebc028931123bd305bff0404c73949eb4e9364b239a198016de8_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9d75a5f20193ebc028931123bd305bff0404c73949eb4e9364b239a198016de8_s390x, registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9d75a5f20193ebc028931123bd305bff0404c73949eb4e9364b239a198016de8_s390x |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0f8658ed23924a3b59fda14288d721fcd5ee4750d1060c316af1c2cb0180dbca_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0f8658ed23924a3b59fda14288d721fcd5ee4750d1060c316af1c2cb0180dbca_amd64, registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0f8658ed23924a3b59fda14288d721fcd5ee4750d1060c316af1c2cb0180dbca_amd64, registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0f8658ed23924a3b59fda14288d721fcd5ee4750d1060c316af1c2cb0180dbca_amd64 |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:dfd187d0ffc8597b30060d9b74e39505dae34783c2560cefc3b2ea5dfb1f4993_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/vector-rhel9@sha256:dfd187d0ffc8597b30060d9b74e39505dae34783c2560cefc3b2ea5dfb1f4993_ppc64le, registry.redhat.io/openshift-logging/vector-rhel9@sha256:dfd187d0ffc8597b30060d9b74e39505dae34783c2560cefc3b2ea5dfb1f4993_ppc64le, registry.redhat.io/openshift-logging/vector-rhel9@sha256:dfd187d0ffc8597b30060d9b74e39505dae34783c2560cefc3b2ea5dfb1f4993_ppc64le |
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:c88d0b886366991bb212aa43f5c983f284f8ebeb9da44c64f08324c2ba2d999d_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:c88d0b886366991bb212aa43f5c983f284f8ebeb9da44c64f08324c2ba2d999d_amd64, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:c88d0b886366991bb212aa43f5c983f284f8ebeb9da44c64f08324c2ba2d999d_amd64 |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d0ce4099e7b19248523f1833225482d31af789934bb82ddae9c41546a4109b06_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d0ce4099e7b19248523f1833225482d31af789934bb82ddae9c41546a4109b06_ppc64le, registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d0ce4099e7b19248523f1833225482d31af789934bb82ddae9c41546a4109b06_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0f8658ed23924a3b59fda14288d721fcd5ee4750d1060c316af1c2cb0180dbca_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0f8658ed23924a3b59fda14288d721fcd5ee4750d1060c316af1c2cb0180dbca_amd64, registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0f8658ed23924a3b59fda14288d721fcd5ee4750d1060c316af1c2cb0180dbca_amd64, registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0f8658ed23924a3b59fda14288d721fcd5ee4750d1060c316af1c2cb0180dbca_amd64 |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:2e861ab6966c4cb4739f26a0b27367ca909ebcdd854c5834e1fed861b05f6dce_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, *, registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:2e861ab6966c4cb4739f26a0b27367ca909ebcdd854c5834e1fed861b05f6dce_arm64 |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:11d2e6ca9a3406ebc4e4426efe4b27b70775b9f74ebe79a3b144d6a975cb7532_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:11d2e6ca9a3406ebc4e4426efe4b27b70775b9f74ebe79a3b144d6a975cb7532_ppc64le, registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:11d2e6ca9a3406ebc4e4426efe4b27b70775b9f74ebe79a3b144d6a975cb7532_ppc64le |
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:ba0c576afe3876ea101af54d5073092f89833585c2d52422d7130f3f337e3a5f_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:ba0c576afe3876ea101af54d5073092f89833585c2d52422d7130f3f337e3a5f_ppc64le, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:ba0c576afe3876ea101af54d5073092f89833585c2d52422d7130f3f337e3a5f_ppc64le |
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:cd039ebbae3373ec31196541193114e5ac90facb6d23e05b3a9080dd7539a805_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:cd039ebbae3373ec31196541193114e5ac90facb6d23e05b3a9080dd7539a805_arm64, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:cd039ebbae3373ec31196541193114e5ac90facb6d23e05b3a9080dd7539a805_arm64, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:cd039ebbae3373ec31196541193114e5ac90facb6d23e05b3a9080dd7539a805_arm64 |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:424cf4c9f4df5a3f958b68869a3cad6dcda351fd863edc9e33b7da30c71f626e_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, *, registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:424cf4c9f4df5a3f958b68869a3cad6dcda351fd863edc9e33b7da30c71f626e_arm64 |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:467699207e663131466c2ca929090adec4692515cae4af4c104de59286143701_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:467699207e663131466c2ca929090adec4692515cae4af4c104de59286143701_s390x, registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:467699207e663131466c2ca929090adec4692515cae4af4c104de59286143701_s390x, registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:467699207e663131466c2ca929090adec4692515cae4af4c104de59286143701_s390x |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:dc69c9c31f053dac9d43a18a551c07e2ffbfca93d7957cc2ab842c7ff3013426_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/vector-rhel9@sha256:dc69c9c31f053dac9d43a18a551c07e2ffbfca93d7957cc2ab842c7ff3013426_s390x, *, registry.redhat.io/openshift-logging/vector-rhel9@sha256:dc69c9c31f053dac9d43a18a551c07e2ffbfca93d7957cc2ab842c7ff3013426_s390x |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ffe4ec982e1838027e7f70ff71adcead812cbb5f4b446e6ec835a42083533b50_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ffe4ec982e1838027e7f70ff71adcead812cbb5f4b446e6ec835a42083533b50_amd64, *, * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:94cd467b2d31f9768d1259169654739a311a43a7983f250bbee397c2a85f3f34_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:94cd467b2d31f9768d1259169654739a311a43a7983f250bbee397c2a85f3f34_arm64, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:94cd467b2d31f9768d1259169654739a311a43a7983f250bbee397c2a85f3f34_arm64, * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:424cf4c9f4df5a3f958b68869a3cad6dcda351fd863edc9e33b7da30c71f626e_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:424cf4c9f4df5a3f958b68869a3cad6dcda351fd863edc9e33b7da30c71f626e_arm64, registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:424cf4c9f4df5a3f958b68869a3cad6dcda351fd863edc9e33b7da30c71f626e_arm64, registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:424cf4c9f4df5a3f958b68869a3cad6dcda351fd863edc9e33b7da30c71f626e_arm64 |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9d75a5f20193ebc028931123bd305bff0404c73949eb4e9364b239a198016de8_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, *, registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9d75a5f20193ebc028931123bd305bff0404c73949eb4e9364b239a198016de8_s390x |
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:cd039ebbae3373ec31196541193114e5ac90facb6d23e05b3a9080dd7539a805_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:cd039ebbae3373ec31196541193114e5ac90facb6d23e05b3a9080dd7539a805_arm64, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:cd039ebbae3373ec31196541193114e5ac90facb6d23e05b3a9080dd7539a805_arm64, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:cd039ebbae3373ec31196541193114e5ac90facb6d23e05b3a9080dd7539a805_arm64 |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56402df10d454bad662e726383c0d71da8d5f5b52993e4a4d041a247897061c2_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56402df10d454bad662e726383c0d71da8d5f5b52993e4a4d041a247897061c2_amd64, registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56402df10d454bad662e726383c0d71da8d5f5b52993e4a4d041a247897061c2_amd64, * |
…and 49 more
Timeline
- Dec 17, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:23534 advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23534.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
- https://go.dev/cl/652155 advisory
- https://go.dev/issue/71490 advisory
- https://pkg.go.dev/vuln/GO-2025-3488 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://www.cve.org/CVERecord?id=CVE-2025-30204 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-30204 advisory
- https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 advisory
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp advisory
- https://pkg.go.dev/vuln/GO-2025-3553 advisory