VDB
RHSA-2025%3A4473
RHSA-2025%3A4473
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | multicluster-engine/must-gather-rhel9@sha256:144b59ca96690e59c748dbd7774e7bed8fdfabb2a36b2b0b5047783cdad9d81e_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/must-gather-rhel9@sha256:144b59ca96690e59c748dbd7774e7bed8fdfabb2a36b2b0b5047783cdad9d81e_amd64, multicluster-engine/must-gather-rhel9@sha256:144b59ca96690e59c748dbd7774e7bed8fdfabb2a36b2b0b5047783cdad9d81e_amd64, multicluster-engine/must-gather-rhel9@sha256:144b59ca96690e59c748dbd7774e7bed8fdfabb2a36b2b0b5047783cdad9d81e_amd64 |
| Red Hat | multicluster-engine/hypershift-cli-rhel9@sha256:01f524d64e3f0f86f17aaa3e7b34b1a66375c43559653f1194062db188489b3d_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/hypershift-cli-rhel9@sha256:01f524d64e3f0f86f17aaa3e7b34b1a66375c43559653f1194062db188489b3d_amd64, multicluster-engine/hypershift-cli-rhel9@sha256:01f524d64e3f0f86f17aaa3e7b34b1a66375c43559653f1194062db188489b3d_amd64, multicluster-engine/hypershift-cli-rhel9@sha256:01f524d64e3f0f86f17aaa3e7b34b1a66375c43559653f1194062db188489b3d_amd64 |
| Red Hat | multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:43cc840032d91ff1a6f29764df80dc316591d36104f0394eb56ff2b8b0e9400a_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:43cc840032d91ff1a6f29764df80dc316591d36104f0394eb56ff2b8b0e9400a_ppc64le, multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:43cc840032d91ff1a6f29764df80dc316591d36104f0394eb56ff2b8b0e9400a_ppc64le, multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:43cc840032d91ff1a6f29764df80dc316591d36104f0394eb56ff2b8b0e9400a_ppc64le |
| Red Hat | multicluster-engine/backplane-rhel9-operator@sha256:f27af31229001468893d0c5fc346e2b2aa8b31a9633b1d56ed717aacd909d9a5_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/backplane-rhel9-operator@sha256:f27af31229001468893d0c5fc346e2b2aa8b31a9633b1d56ed717aacd909d9a5_ppc64le, multicluster-engine/backplane-rhel9-operator@sha256:f27af31229001468893d0c5fc346e2b2aa8b31a9633b1d56ed717aacd909d9a5_ppc64le, multicluster-engine/backplane-rhel9-operator@sha256:f27af31229001468893d0c5fc346e2b2aa8b31a9633b1d56ed717aacd909d9a5_ppc64le |
| Red Hat | multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:6def337b1080ca2a5829281d18fcace2b13fa4f59f491bf88c4b4898d4332a5a_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | *, multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:6def337b1080ca2a5829281d18fcace2b13fa4f59f491bf88c4b4898d4332a5a_amd64, * |
| Red Hat | multicluster-engine/agent-service-rhel8@sha256:01a482bd8639ba7471241bf5ea4d2c7b9f22dc2ff35000f5e666382d7b0fb583_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | multicluster-engine/agent-service-rhel8@sha256:01a482bd8639ba7471241bf5ea4d2c7b9f22dc2ff35000f5e666382d7b0fb583_arm64, multicluster-engine/agent-service-rhel8@sha256:01a482bd8639ba7471241bf5ea4d2c7b9f22dc2ff35000f5e666382d7b0fb583_arm64, multicluster-engine/agent-service-rhel8@sha256:01a482bd8639ba7471241bf5ea4d2c7b9f22dc2ff35000f5e666382d7b0fb583_arm64 |
| Red Hat | multicluster-engine/backplane-rhel9-operator@sha256:96a400c602ff48738a7a1d1a8f83f8fb7096b5e303772f01eda563af6ca3c6a9_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | *, multicluster-engine/backplane-rhel9-operator@sha256:96a400c602ff48738a7a1d1a8f83f8fb7096b5e303772f01eda563af6ca3c6a9_s390x, multicluster-engine/backplane-rhel9-operator@sha256:96a400c602ff48738a7a1d1a8f83f8fb7096b5e303772f01eda563af6ca3c6a9_s390x |
| Red Hat | multicluster-engine/agent-service-rhel8@sha256:d055c380b605d45f3d49179347770eb405aceb046f3c3ee978845c2eebe18bbf_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | multicluster-engine/agent-service-rhel8@sha256:d055c380b605d45f3d49179347770eb405aceb046f3c3ee978845c2eebe18bbf_ppc64le, multicluster-engine/agent-service-rhel8@sha256:d055c380b605d45f3d49179347770eb405aceb046f3c3ee978845c2eebe18bbf_ppc64le, multicluster-engine/agent-service-rhel8@sha256:d055c380b605d45f3d49179347770eb405aceb046f3c3ee978845c2eebe18bbf_ppc64le |
| Red Hat | multicluster-engine/assisted-installer-rhel8@sha256:3db87f322e95aeb509e01b758855db3402f621112b48c292a374f6cae0f1bdab_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | multicluster-engine/assisted-installer-rhel8@sha256:3db87f322e95aeb509e01b758855db3402f621112b48c292a374f6cae0f1bdab_ppc64le, *, multicluster-engine/assisted-installer-rhel8@sha256:3db87f322e95aeb509e01b758855db3402f621112b48c292a374f6cae0f1bdab_ppc64le |
| Red Hat | multicluster-engine/multicloud-manager-rhel9@sha256:817ab6986357f2d113573cadef3608b02876d371a3e83fb448cf978607822296_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | *, multicluster-engine/multicloud-manager-rhel9@sha256:817ab6986357f2d113573cadef3608b02876d371a3e83fb448cf978607822296_ppc64le, multicluster-engine/multicloud-manager-rhel9@sha256:817ab6986357f2d113573cadef3608b02876d371a3e83fb448cf978607822296_ppc64le |
| Red Hat | multicluster-engine/assisted-image-service-rhel8@sha256:b50925b428bb13e32ff9ff55e0407662d3ac2cd2a748e4e8bdbb69f7de960d48_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | multicluster-engine/assisted-image-service-rhel8@sha256:b50925b428bb13e32ff9ff55e0407662d3ac2cd2a748e4e8bdbb69f7de960d48_s390x, multicluster-engine/assisted-image-service-rhel8@sha256:b50925b428bb13e32ff9ff55e0407662d3ac2cd2a748e4e8bdbb69f7de960d48_s390x, multicluster-engine/assisted-image-service-rhel8@sha256:b50925b428bb13e32ff9ff55e0407662d3ac2cd2a748e4e8bdbb69f7de960d48_s390x |
| Red Hat | multicluster-engine/multicloud-manager-rhel9@sha256:9682a5e9d28a49b6cb5b7d80ad388525130cf8487bad1bbd42537618784abdcb_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | *, *, * |
| Red Hat | multicluster-engine/cluster-curator-controller-rhel9@sha256:e9f6525cb2e1d8a45de64413a372cc9342ab7ba4a6e7130a35e3d06e11e07a5e_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | *, multicluster-engine/cluster-curator-controller-rhel9@sha256:e9f6525cb2e1d8a45de64413a372cc9342ab7ba4a6e7130a35e3d06e11e07a5e_amd64, multicluster-engine/cluster-curator-controller-rhel9@sha256:e9f6525cb2e1d8a45de64413a372cc9342ab7ba4a6e7130a35e3d06e11e07a5e_amd64 |
| Red Hat | multicluster-engine/cluster-image-set-controller-rhel9@sha256:6f20b9ace6f0e3a1257ff825c84dd8fa981b984fe6359b2f181f56840573e2f9_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/cluster-image-set-controller-rhel9@sha256:6f20b9ace6f0e3a1257ff825c84dd8fa981b984fe6359b2f181f56840573e2f9_arm64, multicluster-engine/cluster-image-set-controller-rhel9@sha256:6f20b9ace6f0e3a1257ff825c84dd8fa981b984fe6359b2f181f56840573e2f9_arm64, multicluster-engine/cluster-image-set-controller-rhel9@sha256:6f20b9ace6f0e3a1257ff825c84dd8fa981b984fe6359b2f181f56840573e2f9_arm64 |
| Red Hat | multicluster-engine/aws-encryption-provider-rhel9@sha256:7b6ec951cdacf60d53dad1d07de0310fd35f784f0713e60f2cbb4c6753bd0b41_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | *, *, multicluster-engine/aws-encryption-provider-rhel9@sha256:7b6ec951cdacf60d53dad1d07de0310fd35f784f0713e60f2cbb4c6753bd0b41_amd64 |
| Red Hat | multicluster-engine/aws-encryption-provider-rhel9@sha256:5d0e827a20e772696febd4ae7a91c78f674659ccb99b80fa06de130901ec4e10_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/aws-encryption-provider-rhel9@sha256:5d0e827a20e772696febd4ae7a91c78f674659ccb99b80fa06de130901ec4e10_ppc64le, multicluster-engine/aws-encryption-provider-rhel9@sha256:5d0e827a20e772696febd4ae7a91c78f674659ccb99b80fa06de130901ec4e10_ppc64le, * |
| Red Hat | multicluster-engine/cluster-proxy-rhel9@sha256:0e786529d1ddd101462daf7586fc4a56f7f3109f1e5ada5158acf8e69a27a4bc_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | *, *, * |
| Red Hat | multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:27b6d661a02f3f3d9e7129e95a7d76ef83a8372592b232ed8c55942bfc2d5d8f_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:27b6d661a02f3f3d9e7129e95a7d76ef83a8372592b232ed8c55942bfc2d5d8f_ppc64le, *, multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:27b6d661a02f3f3d9e7129e95a7d76ef83a8372592b232ed8c55942bfc2d5d8f_ppc64le |
| Red Hat | multicluster-engine/backplane-rhel9-operator@sha256:254d95d5c6e22ca1cc453108770baa0d603eee65e051781bb24f7f687d48bf7b_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/backplane-rhel9-operator@sha256:254d95d5c6e22ca1cc453108770baa0d603eee65e051781bb24f7f687d48bf7b_arm64, multicluster-engine/backplane-rhel9-operator@sha256:254d95d5c6e22ca1cc453108770baa0d603eee65e051781bb24f7f687d48bf7b_arm64, * |
| Red Hat | multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:091f763a9e95a17b76f48b2144a7cff65926d77f7e67b9a8863ba85107bd4d9b_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:091f763a9e95a17b76f48b2144a7cff65926d77f7e67b9a8863ba85107bd4d9b_arm64, *, * |
…and 277 more
Timeline
- May 5, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:4473 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4473.json advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
- https://go.dev/cl/652155 advisory
- https://go.dev/issue/71490 advisory
- https://pkg.go.dev/vuln/GO-2025-3488 advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-30204 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-30204 advisory
- https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 advisory
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp advisory
- https://pkg.go.dev/vuln/GO-2025-3553 advisory