VDB

RHSA-2025%3A2567

RHSA-2025%3A2567 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatadvanced-cluster-security/rhacs-central-db-rhel8@sha256:e956f2b8af66f5311726d519361e0337aa3fa3ff7d11eedfbea7664d5409aef8_s390x as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-central-db-rhel8@sha256:e956f2b8af66f5311726d519361e0337aa3fa3ff7d11eedfbea7664d5409aef8_s390x, *, advanced-cluster-security/rhacs-central-db-rhel8@sha256:e956f2b8af66f5311726d519361e0337aa3fa3ff7d11eedfbea7664d5409aef8_s390x
Red Hatadvanced-cluster-security/rhacs-collector-rhel8@sha256:006c810f7830497c6f3c8fdc1cc8dcb9d00c40d3258b0e20e60ba8ebbfb520a5_amd64 as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-collector-rhel8@sha256:006c810f7830497c6f3c8fdc1cc8dcb9d00c40d3258b0e20e60ba8ebbfb520a5_amd64, *, *
Red Hatadvanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:1ae2b15e3ed23481684ae5c4cb496163da4f5467fa58f283afad0497e69d2dff_arm64 as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:1ae2b15e3ed23481684ae5c4cb496163da4f5467fa58f283afad0497e69d2dff_arm64, *, *
Red Hatadvanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:cd3c004180e23af0991feee00ce5ed1490776c2993286c833115a02fcf8e1c03_arm64 as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:cd3c004180e23af0991feee00ce5ed1490776c2993286c833115a02fcf8e1c03_arm64, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:cd3c004180e23af0991feee00ce5ed1490776c2993286c833115a02fcf8e1c03_arm64, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:cd3c004180e23af0991feee00ce5ed1490776c2993286c833115a02fcf8e1c03_arm64
Red Hatadvanced-cluster-security/rhacs-rhel8-operator@sha256:294c0e075d63ffe92c8c2e0bb97c4c4aa5e3ec8156a33caf635ce6e4703395c6_ppc64le as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-rhel8-operator@sha256:294c0e075d63ffe92c8c2e0bb97c4c4aa5e3ec8156a33caf635ce6e4703395c6_ppc64le, advanced-cluster-security/rhacs-rhel8-operator@sha256:294c0e075d63ffe92c8c2e0bb97c4c4aa5e3ec8156a33caf635ce6e4703395c6_ppc64le, advanced-cluster-security/rhacs-rhel8-operator@sha256:294c0e075d63ffe92c8c2e0bb97c4c4aa5e3ec8156a33caf635ce6e4703395c6_ppc64le
Red Hatadvanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:829dcad2f3367dbfcc90aa677be120f7801c888c924b15a8bf9445ad9ae993cf_arm64 as a component of RHACS 4.6 for RHEL 8*, *, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:829dcad2f3367dbfcc90aa677be120f7801c888c924b15a8bf9445ad9ae993cf_arm64
Red Hatadvanced-cluster-security/rhacs-scanner-db-rhel8@sha256:964411cda007fc01f99386fc4acc5c36e4b3d453ebf7a6ce7711f9e2d3e7b0dc_amd64 as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:964411cda007fc01f99386fc4acc5c36e4b3d453ebf7a6ce7711f9e2d3e7b0dc_amd64, *, *
Red Hatadvanced-cluster-security/rhacs-scanner-db-rhel8@sha256:a503681fffff78a5666541ba334961331ed09c54549a1613173507b4f949411b_ppc64le as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:a503681fffff78a5666541ba334961331ed09c54549a1613173507b4f949411b_ppc64le, *, *
Red Hatadvanced-cluster-security/rhacs-central-db-rhel8@sha256:22bcae8f251183fd13502b2e3dcb60ba4c10a21bcc098ec7dbedbc43f6bfdc06_arm64 as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-central-db-rhel8@sha256:22bcae8f251183fd13502b2e3dcb60ba4c10a21bcc098ec7dbedbc43f6bfdc06_arm64, *, *
Red Hatadvanced-cluster-security/rhacs-main-rhel8@sha256:2d09a66f007bd37715d15af6e645950242ee5adfa4cb1c5e4a27e491b2ae3aec_ppc64le as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-main-rhel8@sha256:2d09a66f007bd37715d15af6e645950242ee5adfa4cb1c5e4a27e491b2ae3aec_ppc64le, advanced-cluster-security/rhacs-main-rhel8@sha256:2d09a66f007bd37715d15af6e645950242ee5adfa4cb1c5e4a27e491b2ae3aec_ppc64le, advanced-cluster-security/rhacs-main-rhel8@sha256:2d09a66f007bd37715d15af6e645950242ee5adfa4cb1c5e4a27e491b2ae3aec_ppc64le
Red Hatadvanced-cluster-security/rhacs-rhel8-operator@sha256:2b33a1beb97678b9eb96d41620b5b8cb88deea8781b5dd3edef3bd437b18d2a0_s390x as a component of RHACS 4.6 for RHEL 8*, *, advanced-cluster-security/rhacs-rhel8-operator@sha256:2b33a1beb97678b9eb96d41620b5b8cb88deea8781b5dd3edef3bd437b18d2a0_s390x
Red Hatadvanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e61c388fff2fb17283e804149cca914d5b04d2ee4f049f0e92b879f50eea24b7_s390x as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e61c388fff2fb17283e804149cca914d5b04d2ee4f049f0e92b879f50eea24b7_s390x, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e61c388fff2fb17283e804149cca914d5b04d2ee4f049f0e92b879f50eea24b7_s390x, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e61c388fff2fb17283e804149cca914d5b04d2ee4f049f0e92b879f50eea24b7_s390x
Red Hatadvanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:e577b939099798cbb5fc0e31c9781d2a2698a5fd05368e4ab2136173a569e43c_s390x as a component of RHACS 4.6 for RHEL 8*, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:e577b939099798cbb5fc0e31c9781d2a2698a5fd05368e4ab2136173a569e43c_s390x, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:e577b939099798cbb5fc0e31c9781d2a2698a5fd05368e4ab2136173a569e43c_s390x
Red Hatadvanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:7d358d045bbaffacdeefe8d3859dad3c7937e2ba7c365e83c82cf5ee0cea2745_arm64 as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:7d358d045bbaffacdeefe8d3859dad3c7937e2ba7c365e83c82cf5ee0cea2745_arm64, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:7d358d045bbaffacdeefe8d3859dad3c7937e2ba7c365e83c82cf5ee0cea2745_arm64, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:7d358d045bbaffacdeefe8d3859dad3c7937e2ba7c365e83c82cf5ee0cea2745_arm64
Red Hatadvanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:1d2989c7818de56bdcd83dec47c61ead2d163ecbdc7fdcde3e98638e63246017_s390x as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:1d2989c7818de56bdcd83dec47c61ead2d163ecbdc7fdcde3e98638e63246017_s390x, advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:1d2989c7818de56bdcd83dec47c61ead2d163ecbdc7fdcde3e98638e63246017_s390x, advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:1d2989c7818de56bdcd83dec47c61ead2d163ecbdc7fdcde3e98638e63246017_s390x
Red Hatadvanced-cluster-security/rhacs-collector-rhel8@sha256:9be86038bbb8172a4eb43ae5997c2d4043c7293c5bfbb8cd41ea8199af7d4249_arm64 as a component of RHACS 4.6 for RHEL 8*, advanced-cluster-security/rhacs-collector-rhel8@sha256:9be86038bbb8172a4eb43ae5997c2d4043c7293c5bfbb8cd41ea8199af7d4249_arm64, advanced-cluster-security/rhacs-collector-rhel8@sha256:9be86038bbb8172a4eb43ae5997c2d4043c7293c5bfbb8cd41ea8199af7d4249_arm64
Red Hatadvanced-cluster-security/rhacs-main-rhel8@sha256:b2859dc9e82e1345cc36422c02fc5643a72266ca7084f6bb29d5e1459e8157c1_amd64 as a component of RHACS 4.6 for RHEL 8*, advanced-cluster-security/rhacs-main-rhel8@sha256:b2859dc9e82e1345cc36422c02fc5643a72266ca7084f6bb29d5e1459e8157c1_amd64, advanced-cluster-security/rhacs-main-rhel8@sha256:b2859dc9e82e1345cc36422c02fc5643a72266ca7084f6bb29d5e1459e8157c1_amd64
Red Hatadvanced-cluster-security/rhacs-operator-bundle@sha256:74f433e680f61da137e1bc6401c36678c7ec678a490345d3193315ae824831b7_s390x as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-operator-bundle@sha256:74f433e680f61da137e1bc6401c36678c7ec678a490345d3193315ae824831b7_s390x, advanced-cluster-security/rhacs-operator-bundle@sha256:74f433e680f61da137e1bc6401c36678c7ec678a490345d3193315ae824831b7_s390x, advanced-cluster-security/rhacs-operator-bundle@sha256:74f433e680f61da137e1bc6401c36678c7ec678a490345d3193315ae824831b7_s390x
Red Hatadvanced-cluster-security/rhacs-central-db-rhel8@sha256:22bcae8f251183fd13502b2e3dcb60ba4c10a21bcc098ec7dbedbc43f6bfdc06_arm64 as a component of RHACS 4.6 for RHEL 8advanced-cluster-security/rhacs-central-db-rhel8@sha256:22bcae8f251183fd13502b2e3dcb60ba4c10a21bcc098ec7dbedbc43f6bfdc06_arm64, advanced-cluster-security/rhacs-central-db-rhel8@sha256:22bcae8f251183fd13502b2e3dcb60ba4c10a21bcc098ec7dbedbc43f6bfdc06_arm64, advanced-cluster-security/rhacs-central-db-rhel8@sha256:22bcae8f251183fd13502b2e3dcb60ba4c10a21bcc098ec7dbedbc43f6bfdc06_arm64
Red Hatadvanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:eea07dd26602769cfaff48089052c706a69ce406fd7cc794140fc4ddb3f6aeb1_amd64 as a component of RHACS 4.6 for RHEL 8*, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:eea07dd26602769cfaff48089052c706a69ce406fd7cc794140fc4ddb3f6aeb1_amd64, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:eea07dd26602769cfaff48089052c706a69ce406fd7cc794140fc4ddb3f6aeb1_amd64

…and 86 more

Timeline

  • Mar 10, 2025 CVE Published
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Security Advisory
  • Apr 24, 2026 Security Advisory
  • Jul 25, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›