VDB

RHSA-2025%3A3720

RHSA-2025%3A3720 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatmulticluster-engine/kube-rbac-proxy-mce-rhel9@sha256:60b0b1fc266491f29dd778a73ba1cac6415d97335a2f5d70e1aa6ede1036da5b_arm64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 9*, multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:60b0b1fc266491f29dd778a73ba1cac6415d97335a2f5d70e1aa6ede1036da5b_arm64, multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:60b0b1fc266491f29dd778a73ba1cac6415d97335a2f5d70e1aa6ede1036da5b_arm64
Red Hatmulticluster-engine/registration-rhel9@sha256:8edc346568821cdaa81fdcb4f0eee56dfc1477485856ba67740ae6d479a95519_ppc64le as a component of multicluster engine for Kubernetes 2.8 for RHEL 9*, *, multicluster-engine/registration-rhel9@sha256:8edc346568821cdaa81fdcb4f0eee56dfc1477485856ba67740ae6d479a95519_ppc64le
Red Hatmulticluster-engine/managedcluster-import-controller-rhel9@sha256:72bd7cc27ae26bdb1b9ea2a6361b31de71fdf65618b4902d0898f86c8d3fc065_arm64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 9*, multicluster-engine/managedcluster-import-controller-rhel9@sha256:72bd7cc27ae26bdb1b9ea2a6361b31de71fdf65618b4902d0898f86c8d3fc065_arm64, multicluster-engine/managedcluster-import-controller-rhel9@sha256:72bd7cc27ae26bdb1b9ea2a6361b31de71fdf65618b4902d0898f86c8d3fc065_arm64
Red Hatmulticluster-engine/mce-operator-bundle@sha256:1f5c4a3fb695ffbbf04521e7435157fd603311180908d538c59cb4a8062dbaef_amd64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 9*, multicluster-engine/mce-operator-bundle@sha256:1f5c4a3fb695ffbbf04521e7435157fd603311180908d538c59cb4a8062dbaef_amd64, multicluster-engine/mce-operator-bundle@sha256:1f5c4a3fb695ffbbf04521e7435157fd603311180908d538c59cb4a8062dbaef_amd64
Red Hatmulticluster-engine/clusterclaims-controller-rhel9@sha256:a806ed6f9a6b8f2fd1537bfc5c11cd811eb191680ae5b327eefa01c2ce529b3e_s390x as a component of multicluster engine for Kubernetes 2.8 for RHEL 9*, multicluster-engine/clusterclaims-controller-rhel9@sha256:a806ed6f9a6b8f2fd1537bfc5c11cd811eb191680ae5b327eefa01c2ce529b3e_s390x, multicluster-engine/clusterclaims-controller-rhel9@sha256:a806ed6f9a6b8f2fd1537bfc5c11cd811eb191680ae5b327eefa01c2ce529b3e_s390x
Red Hatmulticluster-engine/assisted-image-service-rhel9@sha256:d9a9e8b9ed7917d3a64e98810605edfb723551f38bb6ddc671e1a374748e5b28_s390x as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/assisted-image-service-rhel9@sha256:d9a9e8b9ed7917d3a64e98810605edfb723551f38bb6ddc671e1a374748e5b28_s390x, *, *
Red Hatmulticluster-engine/assisted-service-8-rhel8@sha256:107d873609968b6be379a7f99ca35d8a3ad884549a4b4777025fc5ba0989dec5_arm64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 8*, *, multicluster-engine/assisted-service-8-rhel8@sha256:107d873609968b6be379a7f99ca35d8a3ad884549a4b4777025fc5ba0989dec5_arm64
Red Hatmulticluster-engine/assisted-service-8-rhel8@sha256:b9b5199ae670b9e53cc84a4efbc530b1db914ac232bacdbb24ed3641b3a45b72_s390x as a component of multicluster engine for Kubernetes 2.8 for RHEL 8multicluster-engine/assisted-service-8-rhel8@sha256:b9b5199ae670b9e53cc84a4efbc530b1db914ac232bacdbb24ed3641b3a45b72_s390x, multicluster-engine/assisted-service-8-rhel8@sha256:b9b5199ae670b9e53cc84a4efbc530b1db914ac232bacdbb24ed3641b3a45b72_s390x, multicluster-engine/assisted-service-8-rhel8@sha256:b9b5199ae670b9e53cc84a4efbc530b1db914ac232bacdbb24ed3641b3a45b72_s390x
Red Hatmulticluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:8cc7bfbde00500327e65dcf95266700f04915651ebdc2a87fcf21318f08e6c88_ppc64le as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:8cc7bfbde00500327e65dcf95266700f04915651ebdc2a87fcf21318f08e6c88_ppc64le, multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:8cc7bfbde00500327e65dcf95266700f04915651ebdc2a87fcf21318f08e6c88_ppc64le, multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:8cc7bfbde00500327e65dcf95266700f04915651ebdc2a87fcf21318f08e6c88_ppc64le
Red Hatmulticluster-engine/managed-serviceaccount-rhel9@sha256:eb9babfef8bf1622e0d1ab2d32f90d4e2820a6fc368f7ae4dc755d1066f7ed8d_amd64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/managed-serviceaccount-rhel9@sha256:eb9babfef8bf1622e0d1ab2d32f90d4e2820a6fc368f7ae4dc755d1066f7ed8d_amd64, multicluster-engine/managed-serviceaccount-rhel9@sha256:eb9babfef8bf1622e0d1ab2d32f90d4e2820a6fc368f7ae4dc755d1066f7ed8d_amd64, *
Red Hatmulticluster-engine/assisted-service-8-rhel8@sha256:11ae4165efd6e531c79a343412358a897a1c04b7231e563580730ec7c0946fe1_ppc64le as a component of multicluster engine for Kubernetes 2.8 for RHEL 8multicluster-engine/assisted-service-8-rhel8@sha256:11ae4165efd6e531c79a343412358a897a1c04b7231e563580730ec7c0946fe1_ppc64le, *, *
Red Hatmulticluster-engine/registration-operator-rhel9@sha256:b3a7d2797f2dc266079b1471e38c7fdcfc447fb39036b36ac23471c9c5373fa7_amd64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/registration-operator-rhel9@sha256:b3a7d2797f2dc266079b1471e38c7fdcfc447fb39036b36ac23471c9c5373fa7_amd64, *, *
Red Hatmulticluster-engine/mce-operator-bundle@sha256:290f21b5ee7edb70de78f40486d9da0b31f707d7d5c4f264e9cba05a7bb32db8_s390x as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/mce-operator-bundle@sha256:290f21b5ee7edb70de78f40486d9da0b31f707d7d5c4f264e9cba05a7bb32db8_s390x, *, *
Red Hatmulticluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:45aca365263eeb3ab37bea5e0d222a712146543f91d630ca7b8f5b6a3580ff54_s390x as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:45aca365263eeb3ab37bea5e0d222a712146543f91d630ca7b8f5b6a3580ff54_s390x, *, multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:45aca365263eeb3ab37bea5e0d222a712146543f91d630ca7b8f5b6a3580ff54_s390x
Red Hatmulticluster-engine/work-rhel9@sha256:8a2e943fcb61470695e9a5d5eed48dae0fb14beaccfdf6f178d3443fcf0a68c6_ppc64le as a component of multicluster engine for Kubernetes 2.8 for RHEL 9*, *, *
Red Hatmulticluster-engine/hive-rhel9@sha256:944fa2526680771b6decefe2604bf06db02a970b6350716235958703c21e003b_arm64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/hive-rhel9@sha256:944fa2526680771b6decefe2604bf06db02a970b6350716235958703c21e003b_arm64, multicluster-engine/hive-rhel9@sha256:944fa2526680771b6decefe2604bf06db02a970b6350716235958703c21e003b_arm64, *
Red Hatmulticluster-engine/cluster-proxy-rhel9@sha256:0d646f045b6cbc8108437f728e9ba8c4b7181a114c3c4b76bcf7ee56f118a4b0_amd64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 9*, *, multicluster-engine/cluster-proxy-rhel9@sha256:0d646f045b6cbc8108437f728e9ba8c4b7181a114c3c4b76bcf7ee56f118a4b0_amd64
Red Hatmulticluster-engine/hypershift-cli-rhel9@sha256:3a942342f3588d8718a4039f2e1cb29ca7acc0d8e581666f48ce20198e4de8d0_arm64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/hypershift-cli-rhel9@sha256:3a942342f3588d8718a4039f2e1cb29ca7acc0d8e581666f48ce20198e4de8d0_arm64, multicluster-engine/hypershift-cli-rhel9@sha256:3a942342f3588d8718a4039f2e1cb29ca7acc0d8e581666f48ce20198e4de8d0_arm64, multicluster-engine/hypershift-cli-rhel9@sha256:3a942342f3588d8718a4039f2e1cb29ca7acc0d8e581666f48ce20198e4de8d0_arm64
Red Hatmulticluster-engine/placement-rhel9@sha256:6475775521035a08a31fcef29cd5fc697a72b3c2247631a993a7b729ed7eed1d_arm64 as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/placement-rhel9@sha256:6475775521035a08a31fcef29cd5fc697a72b3c2247631a993a7b729ed7eed1d_arm64, multicluster-engine/placement-rhel9@sha256:6475775521035a08a31fcef29cd5fc697a72b3c2247631a993a7b729ed7eed1d_arm64, multicluster-engine/placement-rhel9@sha256:6475775521035a08a31fcef29cd5fc697a72b3c2247631a993a7b729ed7eed1d_arm64
Red Hatmulticluster-engine/assisted-installer-rhel9@sha256:f0f87ed16ca0ca7410224f5c8aa0401c6f5ae07b988c9827e55c3ed9464b3d13_s390x as a component of multicluster engine for Kubernetes 2.8 for RHEL 9multicluster-engine/assisted-installer-rhel9@sha256:f0f87ed16ca0ca7410224f5c8aa0401c6f5ae07b988c9827e55c3ed9464b3d13_s390x, multicluster-engine/assisted-installer-rhel9@sha256:f0f87ed16ca0ca7410224f5c8aa0401c6f5ae07b988c9827e55c3ed9464b3d13_s390x, multicluster-engine/assisted-installer-rhel9@sha256:f0f87ed16ca0ca7410224f5c8aa0401c6f5ae07b988c9827e55c3ed9464b3d13_s390x

…and 252 more

Timeline

  • Apr 8, 2025 CVE Published
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Security Advisory
  • Apr 24, 2026 Security Advisory
  • Jun 18, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›