VDB

RHSA-2025%3A3437

RHSA-2025%3A3437 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatadvanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:1b408c2f94bdabe114dad06e8474413ed217601de004e505c4a18d4bb2f80d89_s390x as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:1b408c2f94bdabe114dad06e8474413ed217601de004e505c4a18d4bb2f80d89_s390x, *, *
Red Hatadvanced-cluster-security/rhacs-collector-slim-rhel8@sha256:017bf023a9935fa8a8a4470155d8d562e9977ab5ce0066d9125729b071de0ad4_s390x as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:017bf023a9935fa8a8a4470155d8d562e9977ab5ce0066d9125729b071de0ad4_s390x, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:017bf023a9935fa8a8a4470155d8d562e9977ab5ce0066d9125729b071de0ad4_s390x, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:017bf023a9935fa8a8a4470155d8d562e9977ab5ce0066d9125729b071de0ad4_s390x
Red Hatadvanced-cluster-security/rhacs-scanner-db-rhel8@sha256:c2af0e9bcfc1545c87faa1656058e6982eb0ad33ce49988d6201e5923e24b146_ppc64le as a component of RHACS 4.5 for RHEL 8*, *, *
Red Hatadvanced-cluster-security/rhacs-rhel8-operator@sha256:94ab1d45684e1942b3e273cfbbade6fe1ad48082afe538f6152b59f9781df2a0_amd64 as a component of RHACS 4.5 for RHEL 8*, *, advanced-cluster-security/rhacs-rhel8-operator@sha256:94ab1d45684e1942b3e273cfbbade6fe1ad48082afe538f6152b59f9781df2a0_amd64
Red Hatadvanced-cluster-security/rhacs-collector-slim-rhel8@sha256:88e0c7d9ab59e26d2d4202eec5955adfa22a08d2fd1ed2de3101071e157a2ce1_ppc64le as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:88e0c7d9ab59e26d2d4202eec5955adfa22a08d2fd1ed2de3101071e157a2ce1_ppc64le, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:88e0c7d9ab59e26d2d4202eec5955adfa22a08d2fd1ed2de3101071e157a2ce1_ppc64le, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:88e0c7d9ab59e26d2d4202eec5955adfa22a08d2fd1ed2de3101071e157a2ce1_ppc64le
Red Hatadvanced-cluster-security/rhacs-roxctl-rhel8@sha256:c1ae51c87629f4892e3b4586f0059f32b8569851f06f59f726e1c5f9a65f9e95_ppc64le as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-roxctl-rhel8@sha256:c1ae51c87629f4892e3b4586f0059f32b8569851f06f59f726e1c5f9a65f9e95_ppc64le, *, advanced-cluster-security/rhacs-roxctl-rhel8@sha256:c1ae51c87629f4892e3b4586f0059f32b8569851f06f59f726e1c5f9a65f9e95_ppc64le
Red Hatadvanced-cluster-security/rhacs-scanner-rhel8@sha256:0c69bf7a9039a1d343ba1940fcbe6e66f6dfa46d2b78e6ac70892cd847a4fc55_ppc64le as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-scanner-rhel8@sha256:0c69bf7a9039a1d343ba1940fcbe6e66f6dfa46d2b78e6ac70892cd847a4fc55_ppc64le, advanced-cluster-security/rhacs-scanner-rhel8@sha256:0c69bf7a9039a1d343ba1940fcbe6e66f6dfa46d2b78e6ac70892cd847a4fc55_ppc64le, advanced-cluster-security/rhacs-scanner-rhel8@sha256:0c69bf7a9039a1d343ba1940fcbe6e66f6dfa46d2b78e6ac70892cd847a4fc55_ppc64le
Red Hatadvanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:1b408c2f94bdabe114dad06e8474413ed217601de004e505c4a18d4bb2f80d89_s390x as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:1b408c2f94bdabe114dad06e8474413ed217601de004e505c4a18d4bb2f80d89_s390x, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:1b408c2f94bdabe114dad06e8474413ed217601de004e505c4a18d4bb2f80d89_s390x, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:1b408c2f94bdabe114dad06e8474413ed217601de004e505c4a18d4bb2f80d89_s390x
Red Hatadvanced-cluster-security/rhacs-scanner-rhel8@sha256:9e7205874eada2be89406906bd2c159e96195690a6e3575468814b0b76d9c7c5_s390x as a component of RHACS 4.5 for RHEL 8*, advanced-cluster-security/rhacs-scanner-rhel8@sha256:9e7205874eada2be89406906bd2c159e96195690a6e3575468814b0b76d9c7c5_s390x, advanced-cluster-security/rhacs-scanner-rhel8@sha256:9e7205874eada2be89406906bd2c159e96195690a6e3575468814b0b76d9c7c5_s390x
Red Hatadvanced-cluster-security/rhacs-central-db-rhel8@sha256:2cafb5fa71ab6b8c99e675342e151a241bc6e74b1778ce529a4ebfae3e3ca620_ppc64le as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-central-db-rhel8@sha256:2cafb5fa71ab6b8c99e675342e151a241bc6e74b1778ce529a4ebfae3e3ca620_ppc64le, advanced-cluster-security/rhacs-central-db-rhel8@sha256:2cafb5fa71ab6b8c99e675342e151a241bc6e74b1778ce529a4ebfae3e3ca620_ppc64le, advanced-cluster-security/rhacs-central-db-rhel8@sha256:2cafb5fa71ab6b8c99e675342e151a241bc6e74b1778ce529a4ebfae3e3ca620_ppc64le
Red Hatadvanced-cluster-security/rhacs-operator-bundle@sha256:e890f117226469643fd93d0f5cce6800342e442d2955b7f59a5c845ee902ba8e_ppc64le as a component of RHACS 4.5 for RHEL 8*, advanced-cluster-security/rhacs-operator-bundle@sha256:e890f117226469643fd93d0f5cce6800342e442d2955b7f59a5c845ee902ba8e_ppc64le, advanced-cluster-security/rhacs-operator-bundle@sha256:e890f117226469643fd93d0f5cce6800342e442d2955b7f59a5c845ee902ba8e_ppc64le
Red Hatadvanced-cluster-security/rhacs-collector-slim-rhel8@sha256:d1bb55ff658ad2f3ab2c43bf39393063ccf78ed1c262ff947a807a0e4093497e_amd64 as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:d1bb55ff658ad2f3ab2c43bf39393063ccf78ed1c262ff947a807a0e4093497e_amd64, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:d1bb55ff658ad2f3ab2c43bf39393063ccf78ed1c262ff947a807a0e4093497e_amd64, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:d1bb55ff658ad2f3ab2c43bf39393063ccf78ed1c262ff947a807a0e4093497e_amd64
Red Hatadvanced-cluster-security/rhacs-collector-rhel8@sha256:dd9409a53b97d766675129ba0b54e6b4a091265a02c0e373cb37f98339e5716c_ppc64le as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-collector-rhel8@sha256:dd9409a53b97d766675129ba0b54e6b4a091265a02c0e373cb37f98339e5716c_ppc64le, advanced-cluster-security/rhacs-collector-rhel8@sha256:dd9409a53b97d766675129ba0b54e6b4a091265a02c0e373cb37f98339e5716c_ppc64le, advanced-cluster-security/rhacs-collector-rhel8@sha256:dd9409a53b97d766675129ba0b54e6b4a091265a02c0e373cb37f98339e5716c_ppc64le
Red Hatadvanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:f5f15a5ec355f883d1cb489f3ab88ad44395cbc714b6063a03792216130a3eb1_ppc64le as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:f5f15a5ec355f883d1cb489f3ab88ad44395cbc714b6063a03792216130a3eb1_ppc64le, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:f5f15a5ec355f883d1cb489f3ab88ad44395cbc714b6063a03792216130a3eb1_ppc64le, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:f5f15a5ec355f883d1cb489f3ab88ad44395cbc714b6063a03792216130a3eb1_ppc64le
Red Hatadvanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:8070bc31a4c769780dc4d1ff6080d9abdfbc7a899b9ff38ed29ea0b4b60c0360_amd64 as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:8070bc31a4c769780dc4d1ff6080d9abdfbc7a899b9ff38ed29ea0b4b60c0360_amd64, *, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:8070bc31a4c769780dc4d1ff6080d9abdfbc7a899b9ff38ed29ea0b4b60c0360_amd64
Red Hatadvanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:e0f2e8695a7d40cede88f421ba53efa6758cd305d3d73fec4c5183e897ec2add_amd64 as a component of RHACS 4.5 for RHEL 8*, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:e0f2e8695a7d40cede88f421ba53efa6758cd305d3d73fec4c5183e897ec2add_amd64, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:e0f2e8695a7d40cede88f421ba53efa6758cd305d3d73fec4c5183e897ec2add_amd64
Red Hatadvanced-cluster-security/rhacs-collector-slim-rhel8@sha256:d1bb55ff658ad2f3ab2c43bf39393063ccf78ed1c262ff947a807a0e4093497e_amd64 as a component of RHACS 4.5 for RHEL 8*, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:d1bb55ff658ad2f3ab2c43bf39393063ccf78ed1c262ff947a807a0e4093497e_amd64, *
Red Hatadvanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:5b0b04f342363bdd535d51ba95c2aca6d0aaff3640a29dbdf108ad235b06421b_s390x as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:5b0b04f342363bdd535d51ba95c2aca6d0aaff3640a29dbdf108ad235b06421b_s390x, advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:5b0b04f342363bdd535d51ba95c2aca6d0aaff3640a29dbdf108ad235b06421b_s390x, advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:5b0b04f342363bdd535d51ba95c2aca6d0aaff3640a29dbdf108ad235b06421b_s390x
Red Hatadvanced-cluster-security/rhacs-main-rhel8@sha256:6b1668188be2bdff894f3e268a99df669186568153c5bc0fd4b57d5ba730c037_s390x as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-main-rhel8@sha256:6b1668188be2bdff894f3e268a99df669186568153c5bc0fd4b57d5ba730c037_s390x, advanced-cluster-security/rhacs-main-rhel8@sha256:6b1668188be2bdff894f3e268a99df669186568153c5bc0fd4b57d5ba730c037_s390x, advanced-cluster-security/rhacs-main-rhel8@sha256:6b1668188be2bdff894f3e268a99df669186568153c5bc0fd4b57d5ba730c037_s390x
Red Hatadvanced-cluster-security/rhacs-roxctl-rhel8@sha256:c1ae51c87629f4892e3b4586f0059f32b8569851f06f59f726e1c5f9a65f9e95_ppc64le as a component of RHACS 4.5 for RHEL 8advanced-cluster-security/rhacs-roxctl-rhel8@sha256:c1ae51c87629f4892e3b4586f0059f32b8569851f06f59f726e1c5f9a65f9e95_ppc64le, *, *

…and 60 more

Timeline

  • Apr 1, 2025 CVE Published
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Security Advisory
  • Apr 24, 2026 Security Advisory
  • Apr 24, 2026 Security Advisory
  • Jun 18, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›