RHSA-2025%3A3439 — Vulnetix

RHSA-2025%3A3439 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

…and 86 more

Timeline

Apr 1, 2025 CVE Published
Apr 24, 2026 Distribution Patch
Apr 24, 2026 Distribution Patch
Apr 24, 2026 Security Advisory
Apr 24, 2026 Security Advisory
Apr 24, 2026 Security Advisory
Apr 24, 2026 Security Advisory
Jun 18, 2026 CVE Updated

References

https://access.redhat.com/errata/RHSA-2025:3439 advisory
https://access.redhat.com/security/updates/classification/#important advisory
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.6/html-single/release_notes/index advisory
https://issues.redhat.com/browse/ROX-28602 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3439.json advisory
https://access.redhat.com/security/cve/CVE-2025-22868 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
https://go.dev/cl/652155 advisory
https://go.dev/issue/71490 advisory
https://pkg.go.dev/vuln/GO-2025-3488 advisory
https://access.redhat.com/security/cve/CVE-2025-22869 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2348367 issue
https://www.cve.org/CVERecord?id=CVE-2025-22869 advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-22869 advisory
https://go.dev/cl/652135 advisory
https://go.dev/issue/71931 advisory
https://pkg.go.dev/vuln/GO-2025-3487 advisory
https://access.redhat.com/security/cve/CVE-2025-27144 advisory

…and 6 more

Open in Interactive Console →

Vendor	Product	Versions
Red Hat	advanced-cluster-security/rhacs-operator-bundle@sha256:5e0211a77a3fc5027fb005c76d549a1c4792a77b6b198f328a4d13e00d563f94_s390x as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-operator-bundle@sha256:5e0211a77a3fc5027fb005c76d549a1c4792a77b6b198f328a4d13e00d563f94_s390x, *, advanced-cluster-security/rhacs-operator-bundle@sha256:5e0211a77a3fc5027fb005c76d549a1c4792a77b6b198f328a4d13e00d563f94_s390x
Red Hat	advanced-cluster-security/rhacs-roxctl-rhel8@sha256:f77f9bc05fed74f148654aa7204eed4f9b0640ab766f7b11c1e3c3bb0a62d457_s390x as a component of RHACS 4.6 for RHEL 8	, , *
Red Hat	advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:6cfbae6c8cfe46477888d7f917de78934daf1aa529a515a6b6c482ae4ab2e8f5_amd64 as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:6cfbae6c8cfe46477888d7f917de78934daf1aa529a515a6b6c482ae4ab2e8f5_amd64, advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:6cfbae6c8cfe46477888d7f917de78934daf1aa529a515a6b6c482ae4ab2e8f5_amd64, advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:6cfbae6c8cfe46477888d7f917de78934daf1aa529a515a6b6c482ae4ab2e8f5_amd64
Red Hat	advanced-cluster-security/rhacs-scanner-rhel8@sha256:332e4b9b3f71496b7d3c242a33970969027666d4337328495435bc9206fa9106_s390x as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-scanner-rhel8@sha256:332e4b9b3f71496b7d3c242a33970969027666d4337328495435bc9206fa9106_s390x, advanced-cluster-security/rhacs-scanner-rhel8@sha256:332e4b9b3f71496b7d3c242a33970969027666d4337328495435bc9206fa9106_s390x, advanced-cluster-security/rhacs-scanner-rhel8@sha256:332e4b9b3f71496b7d3c242a33970969027666d4337328495435bc9206fa9106_s390x
Red Hat	advanced-cluster-security/rhacs-operator-bundle@sha256:7b49c3de7ae7ce5c5209276f9af6845d0a8e23850f22bad4b49d7b614377994e_ppc64le as a component of RHACS 4.6 for RHEL 8	*, advanced-cluster-security/rhacs-operator-bundle@sha256:7b49c3de7ae7ce5c5209276f9af6845d0a8e23850f22bad4b49d7b614377994e_ppc64le, advanced-cluster-security/rhacs-operator-bundle@sha256:7b49c3de7ae7ce5c5209276f9af6845d0a8e23850f22bad4b49d7b614377994e_ppc64le
Red Hat	advanced-cluster-security/rhacs-operator-bundle@sha256:7b49c3de7ae7ce5c5209276f9af6845d0a8e23850f22bad4b49d7b614377994e_ppc64le as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-operator-bundle@sha256:7b49c3de7ae7ce5c5209276f9af6845d0a8e23850f22bad4b49d7b614377994e_ppc64le, advanced-cluster-security/rhacs-operator-bundle@sha256:7b49c3de7ae7ce5c5209276f9af6845d0a8e23850f22bad4b49d7b614377994e_ppc64le, *
Red Hat	advanced-cluster-security/rhacs-main-rhel8@sha256:a1bbcf94392f867e55b97a8b6c9338280abd4324031628ccaa6808c329d1f51b_arm64 as a component of RHACS 4.6 for RHEL 8	*, advanced-cluster-security/rhacs-main-rhel8@sha256:a1bbcf94392f867e55b97a8b6c9338280abd4324031628ccaa6808c329d1f51b_arm64, advanced-cluster-security/rhacs-main-rhel8@sha256:a1bbcf94392f867e55b97a8b6c9338280abd4324031628ccaa6808c329d1f51b_arm64
Red Hat	advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:fb2da8396ba4c046e963b5c49611a154c3cd47b98701a909a7588631b3ca95c0_ppc64le as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:fb2da8396ba4c046e963b5c49611a154c3cd47b98701a909a7588631b3ca95c0_ppc64le, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:fb2da8396ba4c046e963b5c49611a154c3cd47b98701a909a7588631b3ca95c0_ppc64le, *
Red Hat	advanced-cluster-security/rhacs-rhel8-operator@sha256:6f16d3cee631fe48c46bd37df4d9936a8ad70d4d00a3d3b1405b7b699345e9fe_amd64 as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-rhel8-operator@sha256:6f16d3cee631fe48c46bd37df4d9936a8ad70d4d00a3d3b1405b7b699345e9fe_amd64, advanced-cluster-security/rhacs-rhel8-operator@sha256:6f16d3cee631fe48c46bd37df4d9936a8ad70d4d00a3d3b1405b7b699345e9fe_amd64, *
Red Hat	advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:c9d8e97e70e495f4d268d8d846eed320bae4d94081a42cfdd5503de1fee08ef0_arm64 as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:c9d8e97e70e495f4d268d8d846eed320bae4d94081a42cfdd5503de1fee08ef0_arm64, ,
Red Hat	advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:c5a1b95aadf516f42c11b306168e3682540d7282610bec2eefe97178fc2f5540_s390x as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:c5a1b95aadf516f42c11b306168e3682540d7282610bec2eefe97178fc2f5540_s390x, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:c5a1b95aadf516f42c11b306168e3682540d7282610bec2eefe97178fc2f5540_s390x, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:c5a1b95aadf516f42c11b306168e3682540d7282610bec2eefe97178fc2f5540_s390x
Red Hat	advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:c8f4aff54a4d521ab583e9f6ab16184d70f523127d6329d87ceec853eb272ccb_amd64 as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:c8f4aff54a4d521ab583e9f6ab16184d70f523127d6329d87ceec853eb272ccb_amd64, *, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:c8f4aff54a4d521ab583e9f6ab16184d70f523127d6329d87ceec853eb272ccb_amd64
Red Hat	advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:baec4dda158cc434cf49851d48f64952e1e2ce8e7e0d97f40645f81d6d82acb7_arm64 as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:baec4dda158cc434cf49851d48f64952e1e2ce8e7e0d97f40645f81d6d82acb7_arm64, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:baec4dda158cc434cf49851d48f64952e1e2ce8e7e0d97f40645f81d6d82acb7_arm64, *
Red Hat	advanced-cluster-security/rhacs-roxctl-rhel8@sha256:606aee67225f49de8d3796aceb1a42b4452ffb0c1a45f71abd059d71b6718216_ppc64le as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-roxctl-rhel8@sha256:606aee67225f49de8d3796aceb1a42b4452ffb0c1a45f71abd059d71b6718216_ppc64le, *, advanced-cluster-security/rhacs-roxctl-rhel8@sha256:606aee67225f49de8d3796aceb1a42b4452ffb0c1a45f71abd059d71b6718216_ppc64le
Red Hat	advanced-cluster-security/rhacs-collector-rhel8@sha256:2a54010edca166d59b5a8e0054661c5cbdfd202ff7b2dc8dae3f48e3aa8cdb2c_ppc64le as a component of RHACS 4.6 for RHEL 8	, , advanced-cluster-security/rhacs-collector-rhel8@sha256:2a54010edca166d59b5a8e0054661c5cbdfd202ff7b2dc8dae3f48e3aa8cdb2c_ppc64le
Red Hat	advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:f81a7122296ebedf8212971fa8175477af5382b35cb95109ebeb63ac203b23a0_arm64 as a component of RHACS 4.6 for RHEL 8	, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:f81a7122296ebedf8212971fa8175477af5382b35cb95109ebeb63ac203b23a0_arm64,
Red Hat	advanced-cluster-security/rhacs-operator-bundle@sha256:2ac0811576648d839422548b1587bdf74a0bcc51202cb5312203b6d3632c4d89_arm64 as a component of RHACS 4.6 for RHEL 8	, advanced-cluster-security/rhacs-operator-bundle@sha256:2ac0811576648d839422548b1587bdf74a0bcc51202cb5312203b6d3632c4d89_arm64,
Red Hat	advanced-cluster-security/rhacs-collector-rhel8@sha256:7380fe034ac369d2784544bc102ab0d1992ddd7c34acd820ed90e52c969e68af_arm64 as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-collector-rhel8@sha256:7380fe034ac369d2784544bc102ab0d1992ddd7c34acd820ed90e52c969e68af_arm64, *, advanced-cluster-security/rhacs-collector-rhel8@sha256:7380fe034ac369d2784544bc102ab0d1992ddd7c34acd820ed90e52c969e68af_arm64
Red Hat	advanced-cluster-security/rhacs-central-db-rhel8@sha256:3f7453c244e17e1763cd00bb893dd48153b9f52c639fbe392330f32a8c683b08_arm64 as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-central-db-rhel8@sha256:3f7453c244e17e1763cd00bb893dd48153b9f52c639fbe392330f32a8c683b08_arm64, ,
Red Hat	advanced-cluster-security/rhacs-roxctl-rhel8@sha256:1e41318689a86d45078bcf75a8bb5e888b15af8c3deb1cf4c09b4eacc402af22_amd64 as a component of RHACS 4.6 for RHEL 8	advanced-cluster-security/rhacs-roxctl-rhel8@sha256:1e41318689a86d45078bcf75a8bb5e888b15af8c3deb1cf4c09b4eacc402af22_amd64, ,