VDB

RHSA-2025%3A3987

RHSA-2025%3A3987 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatmulticluster-engine/mce-operator-bundle@sha256:4616133cc5c5c99922ba1b9fd1121bd438eaf4cf474dda041c058251c0a8b2ee_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, multicluster-engine/mce-operator-bundle@sha256:4616133cc5c5c99922ba1b9fd1121bd438eaf4cf474dda041c058251c0a8b2ee_amd64, multicluster-engine/mce-operator-bundle@sha256:4616133cc5c5c99922ba1b9fd1121bd438eaf4cf474dda041c058251c0a8b2ee_amd64
Red Hatmulticluster-engine/cluster-proxy-rhel9@sha256:30e241445a2fbf8b31a5009ac6e4aee4483107f62e1da8a92d3fe4d5ae402e57_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/cluster-proxy-rhel9@sha256:30e241445a2fbf8b31a5009ac6e4aee4483107f62e1da8a92d3fe4d5ae402e57_ppc64le, multicluster-engine/cluster-proxy-rhel9@sha256:30e241445a2fbf8b31a5009ac6e4aee4483107f62e1da8a92d3fe4d5ae402e57_ppc64le, multicluster-engine/cluster-proxy-rhel9@sha256:30e241445a2fbf8b31a5009ac6e4aee4483107f62e1da8a92d3fe4d5ae402e57_ppc64le
Red Hatmulticluster-engine/hypershift-rhel9-operator@sha256:25b1a93aa3d5cfdeba649c2feb3de6cd2588dbffe8a8abf60c0762a22d5bab86_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/hypershift-rhel9-operator@sha256:25b1a93aa3d5cfdeba649c2feb3de6cd2588dbffe8a8abf60c0762a22d5bab86_s390x, multicluster-engine/hypershift-rhel9-operator@sha256:25b1a93aa3d5cfdeba649c2feb3de6cd2588dbffe8a8abf60c0762a22d5bab86_s390x, *
Red Hatmulticluster-engine/backplane-rhel9-operator@sha256:9514e7e736364e10fa4df017990f6717ee40abd485a8783869f9b9e23a6263a1_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/backplane-rhel9-operator@sha256:9514e7e736364e10fa4df017990f6717ee40abd485a8783869f9b9e23a6263a1_s390x, multicluster-engine/backplane-rhel9-operator@sha256:9514e7e736364e10fa4df017990f6717ee40abd485a8783869f9b9e23a6263a1_s390x, multicluster-engine/backplane-rhel9-operator@sha256:9514e7e736364e10fa4df017990f6717ee40abd485a8783869f9b9e23a6263a1_s390x
Red Hatmulticluster-engine/addon-manager-rhel9@sha256:8f0c58c6ae52c2851010fdd76a8b6accb3d0c80d0a66014f8524a739a1842cbd_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, multicluster-engine/addon-manager-rhel9@sha256:8f0c58c6ae52c2851010fdd76a8b6accb3d0c80d0a66014f8524a739a1842cbd_s390x, multicluster-engine/addon-manager-rhel9@sha256:8f0c58c6ae52c2851010fdd76a8b6accb3d0c80d0a66014f8524a739a1842cbd_s390x
Red Hatmulticluster-engine/cluster-proxy-addon-rhel9@sha256:121303230ab89dcc722fbdaae8d0155b8031c0e3a21f762ef04c9c6cf4d86b1f_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, *, *
Red Hatmulticluster-engine/clusterclaims-controller-rhel9@sha256:dabcdf8dc8dca09afff86ab310a03096adc107807099be8db3b6fe21c17cf4d1_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/clusterclaims-controller-rhel9@sha256:dabcdf8dc8dca09afff86ab310a03096adc107807099be8db3b6fe21c17cf4d1_ppc64le, *, *
Red Hatmulticluster-engine/multicloud-manager-rhel9@sha256:7d7e6e85ff3653d1b29463cc970bfe546944b95b3d1b43671514e009c94e4548_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/multicloud-manager-rhel9@sha256:7d7e6e85ff3653d1b29463cc970bfe546944b95b3d1b43671514e009c94e4548_arm64, multicluster-engine/multicloud-manager-rhel9@sha256:7d7e6e85ff3653d1b29463cc970bfe546944b95b3d1b43671514e009c94e4548_arm64, multicluster-engine/multicloud-manager-rhel9@sha256:7d7e6e85ff3653d1b29463cc970bfe546944b95b3d1b43671514e009c94e4548_arm64
Red Hatmulticluster-engine/cluster-curator-controller-rhel9@sha256:c7ef495f93cedfc40603e56a7a5b79b820d574939bdc86dfbd453804eec00044_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, multicluster-engine/cluster-curator-controller-rhel9@sha256:c7ef495f93cedfc40603e56a7a5b79b820d574939bdc86dfbd453804eec00044_arm64, multicluster-engine/cluster-curator-controller-rhel9@sha256:c7ef495f93cedfc40603e56a7a5b79b820d574939bdc86dfbd453804eec00044_arm64
Red Hatmulticluster-engine/hypershift-rhel9-operator@sha256:41640202fcc38f4265045384a7dd8a5ade00a33b7ad421f8905f6d088a76966c_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/hypershift-rhel9-operator@sha256:41640202fcc38f4265045384a7dd8a5ade00a33b7ad421f8905f6d088a76966c_arm64, multicluster-engine/hypershift-rhel9-operator@sha256:41640202fcc38f4265045384a7dd8a5ade00a33b7ad421f8905f6d088a76966c_arm64, multicluster-engine/hypershift-rhel9-operator@sha256:41640202fcc38f4265045384a7dd8a5ade00a33b7ad421f8905f6d088a76966c_arm64
Red Hatmulticluster-engine/cluster-image-set-controller-rhel9@sha256:56097e6205d0319cecebf5985eddcf8224571f95c9ca092f16bf4aa3af02a73e_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/cluster-image-set-controller-rhel9@sha256:56097e6205d0319cecebf5985eddcf8224571f95c9ca092f16bf4aa3af02a73e_arm64, *, multicluster-engine/cluster-image-set-controller-rhel9@sha256:56097e6205d0319cecebf5985eddcf8224571f95c9ca092f16bf4aa3af02a73e_arm64
Red Hatmulticluster-engine/assisted-service-9-rhel9@sha256:b9ab5e49882be9d90fa400f88af42cdd2e3d22d7e403076f044e9813839a37d5_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/assisted-service-9-rhel9@sha256:b9ab5e49882be9d90fa400f88af42cdd2e3d22d7e403076f044e9813839a37d5_arm64, *, *
Red Hatmulticluster-engine/registration-operator-rhel9@sha256:0efd3cb34f67339d4ea0fe315f8d11ea5dd4bccd9e32c6c582bbf5fc179f9356_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/registration-operator-rhel9@sha256:0efd3cb34f67339d4ea0fe315f8d11ea5dd4bccd9e32c6c582bbf5fc179f9356_amd64, *, multicluster-engine/registration-operator-rhel9@sha256:0efd3cb34f67339d4ea0fe315f8d11ea5dd4bccd9e32c6c582bbf5fc179f9356_amd64
Red Hatmulticluster-engine/assisted-installer-agent-rhel9@sha256:d384ab25010f1d6b49aa7712bb67fb4dc39c8c9ed1eb258fa77542472f4985c7_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/assisted-installer-agent-rhel9@sha256:d384ab25010f1d6b49aa7712bb67fb4dc39c8c9ed1eb258fa77542472f4985c7_ppc64le, multicluster-engine/assisted-installer-agent-rhel9@sha256:d384ab25010f1d6b49aa7712bb67fb4dc39c8c9ed1eb258fa77542472f4985c7_ppc64le, multicluster-engine/assisted-installer-agent-rhel9@sha256:d384ab25010f1d6b49aa7712bb67fb4dc39c8c9ed1eb258fa77542472f4985c7_ppc64le
Red Hatmulticluster-engine/provider-credential-controller-rhel9@sha256:7b53d90353084507c6b2f329816a5f288f449d0a00bff6e146f2188789aa56a6_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/provider-credential-controller-rhel9@sha256:7b53d90353084507c6b2f329816a5f288f449d0a00bff6e146f2188789aa56a6_ppc64le, multicluster-engine/provider-credential-controller-rhel9@sha256:7b53d90353084507c6b2f329816a5f288f449d0a00bff6e146f2188789aa56a6_ppc64le, multicluster-engine/provider-credential-controller-rhel9@sha256:7b53d90353084507c6b2f329816a5f288f449d0a00bff6e146f2188789aa56a6_ppc64le
Red Hatmulticluster-engine/assisted-installer-controller-rhel9@sha256:03ae3c4181fa2f0f004b1185b6dd7309f7355dfaa0c52bbb632245451d23a51e_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, multicluster-engine/assisted-installer-controller-rhel9@sha256:03ae3c4181fa2f0f004b1185b6dd7309f7355dfaa0c52bbb632245451d23a51e_ppc64le, multicluster-engine/assisted-installer-controller-rhel9@sha256:03ae3c4181fa2f0f004b1185b6dd7309f7355dfaa0c52bbb632245451d23a51e_ppc64le
Red Hatmulticluster-engine/hypershift-rhel9-operator@sha256:573ebd1194d52fc87991b29c32a7dbc6c032f96579386608642fee106f084b6a_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, multicluster-engine/hypershift-rhel9-operator@sha256:573ebd1194d52fc87991b29c32a7dbc6c032f96579386608642fee106f084b6a_amd64, multicluster-engine/hypershift-rhel9-operator@sha256:573ebd1194d52fc87991b29c32a7dbc6c032f96579386608642fee106f084b6a_amd64
Red Hatmulticluster-engine/cluster-proxy-rhel9@sha256:832b31a868f30f2c2da3d4f90b400367947cd47b1b5cd84f11e60d1df97c6318_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/cluster-proxy-rhel9@sha256:832b31a868f30f2c2da3d4f90b400367947cd47b1b5cd84f11e60d1df97c6318_amd64, multicluster-engine/cluster-proxy-rhel9@sha256:832b31a868f30f2c2da3d4f90b400367947cd47b1b5cd84f11e60d1df97c6318_amd64, multicluster-engine/cluster-proxy-rhel9@sha256:832b31a868f30f2c2da3d4f90b400367947cd47b1b5cd84f11e60d1df97c6318_amd64
Red Hatmulticluster-engine/clusterclaims-controller-rhel9@sha256:52571fe9270e0607dcf970c6e7ad49eb2d906534782036a82a6e37e094695db4_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9multicluster-engine/clusterclaims-controller-rhel9@sha256:52571fe9270e0607dcf970c6e7ad49eb2d906534782036a82a6e37e094695db4_amd64, multicluster-engine/clusterclaims-controller-rhel9@sha256:52571fe9270e0607dcf970c6e7ad49eb2d906534782036a82a6e37e094695db4_amd64, *
Red Hatmulticluster-engine/cluster-curator-controller-rhel9@sha256:dade6874d96b064534a7c1ef06f43452b50c94f8f9ab9159875436e4f6a65fa4_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9*, *, multicluster-engine/cluster-curator-controller-rhel9@sha256:dade6874d96b064534a7c1ef06f43452b50c94f8f9ab9159875436e4f6a65fa4_ppc64le

…and 260 more

Timeline

  • Apr 17, 2025 CVE Published
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Security Advisory
  • Apr 24, 2026 Security Advisory
  • Jun 18, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›