VDB
RHSA-2025%3A2526
RHSA-2025%3A2526
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | advanced-cluster-security/rhacs-operator-bundle@sha256:1a1a57b1d596b804521bef78ee1f31c08d802e62a044194f4f95ee6106ae644c_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-operator-bundle@sha256:1a1a57b1d596b804521bef78ee1f31c08d802e62a044194f4f95ee6106ae644c_s390x, advanced-cluster-security/rhacs-operator-bundle@sha256:1a1a57b1d596b804521bef78ee1f31c08d802e62a044194f4f95ee6106ae644c_s390x, advanced-cluster-security/rhacs-operator-bundle@sha256:1a1a57b1d596b804521bef78ee1f31c08d802e62a044194f4f95ee6106ae644c_s390x |
| Red Hat | advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:a3f7013b82f6888cfb865d1039fe2c996e9d3b1441c4e0e6c3c7d2db52502cfb_amd64 as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:a3f7013b82f6888cfb865d1039fe2c996e9d3b1441c4e0e6c3c7d2db52502cfb_amd64, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:a3f7013b82f6888cfb865d1039fe2c996e9d3b1441c4e0e6c3c7d2db52502cfb_amd64, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-rhel8@sha256:6079044bbfaf67cb0254299f2c5e23eaf8025c8082164c18eae167bec9223d0e_amd64 as a component of RHACS 4.5 for RHEL 8 | *, *, advanced-cluster-security/rhacs-scanner-rhel8@sha256:6079044bbfaf67cb0254299f2c5e23eaf8025c8082164c18eae167bec9223d0e_amd64 |
| Red Hat | advanced-cluster-security/rhacs-collector-rhel8@sha256:4c11e822b0a0aac155dae902d427d23753bf20533caf7ce95e38ee4d6b346af7_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-collector-rhel8@sha256:4c11e822b0a0aac155dae902d427d23753bf20533caf7ce95e38ee4d6b346af7_s390x, advanced-cluster-security/rhacs-collector-rhel8@sha256:4c11e822b0a0aac155dae902d427d23753bf20533caf7ce95e38ee4d6b346af7_s390x, advanced-cluster-security/rhacs-collector-rhel8@sha256:4c11e822b0a0aac155dae902d427d23753bf20533caf7ce95e38ee4d6b346af7_s390x |
| Red Hat | advanced-cluster-security/rhacs-roxctl-rhel8@sha256:02cc7c3cd83358e3fb11aaf55a1f013c9391a9067841841373f2606508a2ed88_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-roxctl-rhel8@sha256:02cc7c3cd83358e3fb11aaf55a1f013c9391a9067841841373f2606508a2ed88_s390x, *, advanced-cluster-security/rhacs-roxctl-rhel8@sha256:02cc7c3cd83358e3fb11aaf55a1f013c9391a9067841841373f2606508a2ed88_s390x |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:53e9606642dd1881c04fc4064e2b16250b1f081ca4ded70da1612774307e3215_amd64 as a component of RHACS 4.5 for RHEL 8 | *, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:53e9606642dd1881c04fc4064e2b16250b1f081ca4ded70da1612774307e3215_amd64, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:53e9606642dd1881c04fc4064e2b16250b1f081ca4ded70da1612774307e3215_amd64 |
| Red Hat | advanced-cluster-security/rhacs-collector-rhel8@sha256:4c11e822b0a0aac155dae902d427d23753bf20533caf7ce95e38ee4d6b346af7_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-collector-rhel8@sha256:4c11e822b0a0aac155dae902d427d23753bf20533caf7ce95e38ee4d6b346af7_s390x, advanced-cluster-security/rhacs-collector-rhel8@sha256:4c11e822b0a0aac155dae902d427d23753bf20533caf7ce95e38ee4d6b346af7_s390x, advanced-cluster-security/rhacs-collector-rhel8@sha256:4c11e822b0a0aac155dae902d427d23753bf20533caf7ce95e38ee4d6b346af7_s390x |
| Red Hat | advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:81de464aecfb26937cbff4058ae1c0c7c183fe032af47cbe954d0b1642a39270_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:81de464aecfb26937cbff4058ae1c0c7c183fe032af47cbe954d0b1642a39270_s390x, advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:81de464aecfb26937cbff4058ae1c0c7c183fe032af47cbe954d0b1642a39270_s390x, advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:81de464aecfb26937cbff4058ae1c0c7c183fe032af47cbe954d0b1642a39270_s390x |
| Red Hat | advanced-cluster-security/rhacs-main-rhel8@sha256:9e3ef9e5e6efc943d58355a58098609dabf9115a14522b1369fea643438c19ab_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-main-rhel8@sha256:9e3ef9e5e6efc943d58355a58098609dabf9115a14522b1369fea643438c19ab_s390x, *, * |
| Red Hat | advanced-cluster-security/rhacs-rhel8-operator@sha256:47786dc1915d7cc4cbf71f466de5e777389f0a7a7a48802341c73e57d9c7bbb0_ppc64le as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-rhel8-operator@sha256:47786dc1915d7cc4cbf71f466de5e777389f0a7a7a48802341c73e57d9c7bbb0_ppc64le, *, advanced-cluster-security/rhacs-rhel8-operator@sha256:47786dc1915d7cc4cbf71f466de5e777389f0a7a7a48802341c73e57d9c7bbb0_ppc64le |
| Red Hat | advanced-cluster-security/rhacs-rhel8-operator@sha256:3e9b671b0879f4664655363c9b47efe196fe3260fe3f26ee77db58f32d2402f4_amd64 as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-rhel8-operator@sha256:3e9b671b0879f4664655363c9b47efe196fe3260fe3f26ee77db58f32d2402f4_amd64, advanced-cluster-security/rhacs-rhel8-operator@sha256:3e9b671b0879f4664655363c9b47efe196fe3260fe3f26ee77db58f32d2402f4_amd64, advanced-cluster-security/rhacs-rhel8-operator@sha256:3e9b671b0879f4664655363c9b47efe196fe3260fe3f26ee77db58f32d2402f4_amd64 |
| Red Hat | advanced-cluster-security/rhacs-main-rhel8@sha256:9e3ef9e5e6efc943d58355a58098609dabf9115a14522b1369fea643438c19ab_s390x as a component of RHACS 4.5 for RHEL 8 | *, advanced-cluster-security/rhacs-main-rhel8@sha256:9e3ef9e5e6efc943d58355a58098609dabf9115a14522b1369fea643438c19ab_s390x, advanced-cluster-security/rhacs-main-rhel8@sha256:9e3ef9e5e6efc943d58355a58098609dabf9115a14522b1369fea643438c19ab_s390x |
| Red Hat | advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:ff7f50f0afae0d197e3645b0a2d8337a36d7a6a10731779b728f301d9281a10f_amd64 as a component of RHACS 4.5 for RHEL 8 | *, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:ff7f50f0afae0d197e3645b0a2d8337a36d7a6a10731779b728f301d9281a10f_amd64, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:ff7f50f0afae0d197e3645b0a2d8337a36d7a6a10731779b728f301d9281a10f_amd64 |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:f3549f923bea37741d3daffdcd0bf43f00b4f27073a6c43a63baf7abd86e6e81_s390x as a component of RHACS 4.5 for RHEL 8 | *, *, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:f3549f923bea37741d3daffdcd0bf43f00b4f27073a6c43a63baf7abd86e6e81_s390x |
| Red Hat | advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:931812d283861d7aceb9ad0df0820f81ab7d6409e5bc4d4ad1255fba49e7fed0_amd64 as a component of RHACS 4.5 for RHEL 8 | *, *, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:931812d283861d7aceb9ad0df0820f81ab7d6409e5bc4d4ad1255fba49e7fed0_amd64 |
| Red Hat | advanced-cluster-security/rhacs-collector-rhel8@sha256:dde5a5a36f0e6bb96eacbef6d7592ad70cc92312d8d2c8c8b97f229acb7843cb_ppc64le as a component of RHACS 4.5 for RHEL 8 | *, *, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:043491d646e20633afd12a99826fe56b9f285859bddf4ca888f8fb5718ba806a_s390x as a component of RHACS 4.5 for RHEL 8 | *, *, * |
| Red Hat | advanced-cluster-security/rhacs-main-rhel8@sha256:73153fa459a3054655017e98522e22b9e4def02bbf40edbafa68e3d46c88d0f6_ppc64le as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-main-rhel8@sha256:73153fa459a3054655017e98522e22b9e4def02bbf40edbafa68e3d46c88d0f6_ppc64le, advanced-cluster-security/rhacs-main-rhel8@sha256:73153fa459a3054655017e98522e22b9e4def02bbf40edbafa68e3d46c88d0f6_ppc64le, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:929155d124504fad88add9274dd1aa00cbf1dba4c33615e0a17c6db172d42dff_ppc64le as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:929155d124504fad88add9274dd1aa00cbf1dba4c33615e0a17c6db172d42dff_ppc64le, *, * |
| Red Hat | advanced-cluster-security/rhacs-central-db-rhel8@sha256:6de228ab0ec26cad091603df54cfd8fbd730a11d8e0c75bfb0f9b224b17fa1dc_amd64 as a component of RHACS 4.5 for RHEL 8 | *, *, * |
…and 59 more
Timeline
- Mar 10, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:2526 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.5/html/release_notes/release-notes-45 advisory
- https://issues.redhat.com/browse/ROX-28410 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2526.json advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
- https://go.dev/cl/652155 advisory
- https://go.dev/issue/71490 advisory
- https://pkg.go.dev/vuln/GO-2025-3488 advisory