VDB
RHSA-2025%3A3790
RHSA-2025%3A3790
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-csi-snapshot-controller-rhel9@sha256:4c037e0759241153810f19e3081e6f4c7d5fdcc32115d6ce8a33ed3d7f8f0772_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | *, *, openshift4/ose-csi-snapshot-controller-rhel9@sha256:4c037e0759241153810f19e3081e6f4c7d5fdcc32115d6ce8a33ed3d7f8f0772_amd64 |
| Red Hat | openshift4/ose-csi-external-resizer@sha256:be0d46444eef9773502c18707254602bb10bd9a88a9e4ff31d21cd72a234ba04_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-csi-external-resizer@sha256:be0d46444eef9773502c18707254602bb10bd9a88a9e4ff31d21cd72a234ba04_amd64, *, openshift4/ose-csi-external-resizer@sha256:be0d46444eef9773502c18707254602bb10bd9a88a9e4ff31d21cd72a234ba04_amd64 |
| Red Hat | openshift4/ose-pod-rhel9@sha256:d36465bdd1ef05ba53e1748fdd1ea48db141f4cc249c69be96b295b2638d5e75_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-pod-rhel9@sha256:d36465bdd1ef05ba53e1748fdd1ea48db141f4cc249c69be96b295b2638d5e75_s390x, *, openshift4/ose-pod-rhel9@sha256:d36465bdd1ef05ba53e1748fdd1ea48db141f4cc249c69be96b295b2638d5e75_s390x |
| Red Hat | openshift4/ose-cli-artifacts@sha256:92788b6ce939253392a3703875c45a2c6b1e2b84c23e3e6bfe5b0ff74b9caca2_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-cli-artifacts@sha256:92788b6ce939253392a3703875c45a2c6b1e2b84c23e3e6bfe5b0ff74b9caca2_ppc64le, openshift4/ose-cli-artifacts@sha256:92788b6ce939253392a3703875c45a2c6b1e2b84c23e3e6bfe5b0ff74b9caca2_ppc64le, openshift4/ose-cli-artifacts@sha256:92788b6ce939253392a3703875c45a2c6b1e2b84c23e3e6bfe5b0ff74b9caca2_ppc64le |
| Red Hat | openshift4/ose-csi-external-provisioner-rhel8@sha256:3588c4f960b3aabd0cc5b8573225ae9cbacbe8f6e7e8c9e37384a15098375d1b_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-csi-external-provisioner-rhel8@sha256:3588c4f960b3aabd0cc5b8573225ae9cbacbe8f6e7e8c9e37384a15098375d1b_amd64, openshift4/ose-csi-external-provisioner-rhel8@sha256:3588c4f960b3aabd0cc5b8573225ae9cbacbe8f6e7e8c9e37384a15098375d1b_amd64, * |
| Red Hat | openshift4/ose-thanos-rhel8@sha256:96c80524e754cbe3903b23f64594fd728d03e28502266977b83ed5ebbbf85830_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-thanos-rhel8@sha256:96c80524e754cbe3903b23f64594fd728d03e28502266977b83ed5ebbbf85830_amd64, *, openshift4/ose-thanos-rhel8@sha256:96c80524e754cbe3903b23f64594fd728d03e28502266977b83ed5ebbbf85830_amd64 |
| Red Hat | openshift4/ose-openstack-cluster-api-controllers-rhel8@sha256:fcca071c7942c721584c13a0a452114e07d132373a5e8b71f52246a5e911d7f6_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/ose-openstack-cluster-api-controllers-rhel8@sha256:fcca071c7942c721584c13a0a452114e07d132373a5e8b71f52246a5e911d7f6_ppc64le, * |
| Red Hat | openshift4/ose-console-rhel9-operator@sha256:5eba1d59a190adcadb2e0af5fc2993d60a2e544fed04643d14fad28cb2eaef56_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-console-rhel9-operator@sha256:5eba1d59a190adcadb2e0af5fc2993d60a2e544fed04643d14fad28cb2eaef56_ppc64le, *, * |
| Red Hat | openshift4/ose-operator-lifecycle-manager-rhel9@sha256:f8b2c96b3d6a4dd2cb5050a8b9e81dacd75328fbd1f354d3d5d9d1a5c989fbf1_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-operator-lifecycle-manager-rhel9@sha256:f8b2c96b3d6a4dd2cb5050a8b9e81dacd75328fbd1f354d3d5d9d1a5c989fbf1_arm64, *, openshift4/ose-operator-lifecycle-manager-rhel9@sha256:f8b2c96b3d6a4dd2cb5050a8b9e81dacd75328fbd1f354d3d5d9d1a5c989fbf1_arm64 |
| Red Hat | openshift4/ose-baremetal-rhel9-operator@sha256:92bd1741798b13a547f568683b92ce9c6ce0f2ce9d6e0e10b0ad77c965ee3d12_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-baremetal-rhel9-operator@sha256:92bd1741798b13a547f568683b92ce9c6ce0f2ce9d6e0e10b0ad77c965ee3d12_arm64, openshift4/ose-baremetal-rhel9-operator@sha256:92bd1741798b13a547f568683b92ce9c6ce0f2ce9d6e0e10b0ad77c965ee3d12_arm64, openshift4/ose-baremetal-rhel9-operator@sha256:92bd1741798b13a547f568683b92ce9c6ce0f2ce9d6e0e10b0ad77c965ee3d12_arm64 |
| Red Hat | openshift4/ose-kubevirt-cloud-controller-manager-rhel9@sha256:19b98b59b04393f163e3ee83be0a3d4d393bece5bde1c8847ecfc79f202abe3c_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/ose-kubevirt-cloud-controller-manager-rhel9@sha256:19b98b59b04393f163e3ee83be0a3d4d393bece5bde1c8847ecfc79f202abe3c_arm64, * |
| Red Hat | openshift4/ose-keepalived-ipfailover-rhel9@sha256:e849436418228c07f7e61842e4ec2f1871f2ad8254fdcb23246dc93a71895def_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | *, *, * |
| Red Hat | openshift4/ose-operator-registry-rhel9@sha256:b4a3fe4b3235638db1b897774c06ddcaa2fd011b5a1deed87da06a422f1b38b8_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | *, *, * |
| Red Hat | openshift4/ose-cluster-config-rhel9-operator@sha256:776bfcbfabf2c634797c04dc6b1a94f864ef0b9835cee80e37cac089f92ea4f7_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-cluster-config-rhel9-operator@sha256:776bfcbfabf2c634797c04dc6b1a94f864ef0b9835cee80e37cac089f92ea4f7_s390x, *, openshift4/ose-cluster-config-rhel9-operator@sha256:776bfcbfabf2c634797c04dc6b1a94f864ef0b9835cee80e37cac089f92ea4f7_s390x |
| Red Hat | openshift4/ose-oauth-apiserver-rhel9@sha256:50efbf887636e65070e9dfcb347fea2846747da8cc4c8515b22b11214fc4e14f_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-oauth-apiserver-rhel9@sha256:50efbf887636e65070e9dfcb347fea2846747da8cc4c8515b22b11214fc4e14f_ppc64le, *, * |
| Red Hat | openshift4/ose-openstack-cluster-api-controllers-rhel8@sha256:231275a0d7deab68abdfdbef02a1f29ca859df8d835c21edefd5672b894b2318_s390x as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/ose-openstack-cluster-api-controllers-rhel8@sha256:231275a0d7deab68abdfdbef02a1f29ca859df8d835c21edefd5672b894b2318_s390x, openshift4/ose-openstack-cluster-api-controllers-rhel8@sha256:231275a0d7deab68abdfdbef02a1f29ca859df8d835c21edefd5672b894b2318_s390x |
| Red Hat | openshift4/ose-installer-altinfra-rhel8@sha256:4047ab253e8048e7d8015ffe559c893c812087621ed6ce231594806d5f716dd9_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/ose-installer-altinfra-rhel8@sha256:4047ab253e8048e7d8015ffe559c893c812087621ed6ce231594806d5f716dd9_ppc64le, openshift4/ose-installer-altinfra-rhel8@sha256:4047ab253e8048e7d8015ffe559c893c812087621ed6ce231594806d5f716dd9_ppc64le |
| Red Hat | openshift4/ose-tools-rhel8@sha256:faac9fe81748b63c8de18f6fc84b1398425b17a373d5edea2007f27fb8057152_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-tools-rhel8@sha256:faac9fe81748b63c8de18f6fc84b1398425b17a373d5edea2007f27fb8057152_arm64, openshift4/ose-tools-rhel8@sha256:faac9fe81748b63c8de18f6fc84b1398425b17a373d5edea2007f27fb8057152_arm64, openshift4/ose-tools-rhel8@sha256:faac9fe81748b63c8de18f6fc84b1398425b17a373d5edea2007f27fb8057152_arm64 |
| Red Hat | openshift4/ose-cluster-bootstrap-rhel9@sha256:14343859478d9f62944706ede60d70fd8f38a6c9a6eea31e146db21318173dd9_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | *, *, openshift4/ose-cluster-bootstrap-rhel9@sha256:14343859478d9f62944706ede60d70fd8f38a6c9a6eea31e146db21318173dd9_arm64 |
| Red Hat | openshift4/ose-olm-rukpak-rhel8@sha256:9be19df1391f3a10939b605f80eae9dd696524d1768fa6f1920add3f8507be35_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-olm-rukpak-rhel8@sha256:9be19df1391f3a10939b605f80eae9dd696524d1768fa6f1920add3f8507be35_arm64, *, * |
…and 1311 more
Timeline
- Apr 17, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jul 25, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:3790 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://issues.redhat.com/browse/OCPBUGS-36688 advisory
- https://issues.redhat.com/browse/OCPBUGS-45961 advisory
- https://issues.redhat.com/browse/OCPBUGS-50591 advisory
- https://issues.redhat.com/browse/OCPBUGS-50867 advisory
- https://issues.redhat.com/browse/OCPBUGS-53055 advisory
- https://issues.redhat.com/browse/OCPBUGS-53138 advisory
- https://issues.redhat.com/browse/OCPBUGS-53139 advisory
- https://issues.redhat.com/browse/OCPBUGS-53384 advisory
- https://issues.redhat.com/browse/OCPBUGS-54252 advisory
- https://issues.redhat.com/browse/OCPBUGS-54353 advisory
- https://issues.redhat.com/browse/OCPBUGS-54367 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3790.json advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
- https://go.dev/cl/652155 advisory
…and 8 more