VDB
RHSA-2025%3A4605
RHSA-2025%3A4605
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | multicluster-engine/cluster-proxy-rhel9@sha256:8d30e09e79866b03f1cf3a35279785996a61f7eec520ecf61832d385db73b36b_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | *, *, multicluster-engine/cluster-proxy-rhel9@sha256:8d30e09e79866b03f1cf3a35279785996a61f7eec520ecf61832d385db73b36b_s390x |
| Red Hat | multicluster-engine/managedcluster-import-controller-rhel9@sha256:3067b6d59bfb3291dfd7938751dfb621862282f8ae1c16f27800a3ea6990c6b6_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/managedcluster-import-controller-rhel9@sha256:3067b6d59bfb3291dfd7938751dfb621862282f8ae1c16f27800a3ea6990c6b6_ppc64le, multicluster-engine/managedcluster-import-controller-rhel9@sha256:3067b6d59bfb3291dfd7938751dfb621862282f8ae1c16f27800a3ea6990c6b6_ppc64le, multicluster-engine/managedcluster-import-controller-rhel9@sha256:3067b6d59bfb3291dfd7938751dfb621862282f8ae1c16f27800a3ea6990c6b6_ppc64le |
| Red Hat | multicluster-engine/placement-rhel9@sha256:8edefac018c45e338972e85f5caa2690dfedd92bdc7c71aa8ca61c576c25f3f8_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | *, *, * |
| Red Hat | multicluster-engine/registration-operator-rhel9@sha256:da73269cd4e8176445a396e38b2ccbe99aaa1227890a6ed5e897db6aebc2b858_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/registration-operator-rhel9@sha256:da73269cd4e8176445a396e38b2ccbe99aaa1227890a6ed5e897db6aebc2b858_ppc64le, multicluster-engine/registration-operator-rhel9@sha256:da73269cd4e8176445a396e38b2ccbe99aaa1227890a6ed5e897db6aebc2b858_ppc64le, multicluster-engine/registration-operator-rhel9@sha256:da73269cd4e8176445a396e38b2ccbe99aaa1227890a6ed5e897db6aebc2b858_ppc64le |
| Red Hat | multicluster-engine/must-gather-rhel9@sha256:86e1331f8e2e7640852affe3800edcf59198d3f8ff90e1ad98e80d60cff2c296_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/must-gather-rhel9@sha256:86e1331f8e2e7640852affe3800edcf59198d3f8ff90e1ad98e80d60cff2c296_ppc64le, multicluster-engine/must-gather-rhel9@sha256:86e1331f8e2e7640852affe3800edcf59198d3f8ff90e1ad98e80d60cff2c296_ppc64le, * |
| Red Hat | multicluster-engine/assisted-image-service-rhel8@sha256:ed32227fb64e33622e8bd9022e18ec1ece3046663cadf7c8f34928df66b199b1_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8 | *, multicluster-engine/assisted-image-service-rhel8@sha256:ed32227fb64e33622e8bd9022e18ec1ece3046663cadf7c8f34928df66b199b1_amd64, multicluster-engine/assisted-image-service-rhel8@sha256:ed32227fb64e33622e8bd9022e18ec1ece3046663cadf7c8f34928df66b199b1_amd64 |
| Red Hat | multicluster-engine/addon-manager-rhel9@sha256:980ce026ba5816f5aae4bc909963697432985ba0dcec17f0d6731f28b543a8d2_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | *, multicluster-engine/addon-manager-rhel9@sha256:980ce026ba5816f5aae4bc909963697432985ba0dcec17f0d6731f28b543a8d2_s390x, multicluster-engine/addon-manager-rhel9@sha256:980ce026ba5816f5aae4bc909963697432985ba0dcec17f0d6731f28b543a8d2_s390x |
| Red Hat | multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c190070818aeecaba52daa774971e0d71d9056d19976a730b58f61f861dc46aa_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:c190070818aeecaba52daa774971e0d71d9056d19976a730b58f61f861dc46aa_ppc64le, *, * |
| Red Hat | multicluster-engine/assisted-service-9-rhel9@sha256:e37ac51cc292ec8045cec10690467a860f6380d46a036df4b9d82a5e0a4611b3_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/assisted-service-9-rhel9@sha256:e37ac51cc292ec8045cec10690467a860f6380d46a036df4b9d82a5e0a4611b3_ppc64le, multicluster-engine/assisted-service-9-rhel9@sha256:e37ac51cc292ec8045cec10690467a860f6380d46a036df4b9d82a5e0a4611b3_ppc64le, multicluster-engine/assisted-service-9-rhel9@sha256:e37ac51cc292ec8045cec10690467a860f6380d46a036df4b9d82a5e0a4611b3_ppc64le |
| Red Hat | multicluster-engine/cluster-proxy-rhel9@sha256:6d3456f60cb1335e6274fa8678f54e673611c630df98c3b51aba9c20578f2355_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | *, *, multicluster-engine/cluster-proxy-rhel9@sha256:6d3456f60cb1335e6274fa8678f54e673611c630df98c3b51aba9c20578f2355_amd64 |
| Red Hat | multicluster-engine/cluster-api-provider-agent-rhel9@sha256:3ab35c6302a233ac1dccb18a2d9aa072e47e060dfad261e275c536df35a2d919_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/cluster-api-provider-agent-rhel9@sha256:3ab35c6302a233ac1dccb18a2d9aa072e47e060dfad261e275c536df35a2d919_arm64, multicluster-engine/cluster-api-provider-agent-rhel9@sha256:3ab35c6302a233ac1dccb18a2d9aa072e47e060dfad261e275c536df35a2d919_arm64, multicluster-engine/cluster-api-provider-agent-rhel9@sha256:3ab35c6302a233ac1dccb18a2d9aa072e47e060dfad261e275c536df35a2d919_arm64 |
| Red Hat | multicluster-engine/registration-rhel9@sha256:8944e1187accbc7e01f66e106adad196bd7840816ca1abde6d195a1f82540eff_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/registration-rhel9@sha256:8944e1187accbc7e01f66e106adad196bd7840816ca1abde6d195a1f82540eff_amd64, multicluster-engine/registration-rhel9@sha256:8944e1187accbc7e01f66e106adad196bd7840816ca1abde6d195a1f82540eff_amd64, multicluster-engine/registration-rhel9@sha256:8944e1187accbc7e01f66e106adad196bd7840816ca1abde6d195a1f82540eff_amd64 |
| Red Hat | multicluster-engine/backplane-rhel9-operator@sha256:a9516bb8afb2f235fa829fa21cbbaa5f21a0f59db2971b9e49c799cea7c65304_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | *, multicluster-engine/backplane-rhel9-operator@sha256:a9516bb8afb2f235fa829fa21cbbaa5f21a0f59db2971b9e49c799cea7c65304_amd64, multicluster-engine/backplane-rhel9-operator@sha256:a9516bb8afb2f235fa829fa21cbbaa5f21a0f59db2971b9e49c799cea7c65304_amd64 |
| Red Hat | multicluster-engine/clusterclaims-controller-rhel9@sha256:a7359ae9df2701713f9c47a40cc2c377ef16e5fdc6fbe047ff9935be78a8caf8_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/clusterclaims-controller-rhel9@sha256:a7359ae9df2701713f9c47a40cc2c377ef16e5fdc6fbe047ff9935be78a8caf8_arm64, multicluster-engine/clusterclaims-controller-rhel9@sha256:a7359ae9df2701713f9c47a40cc2c377ef16e5fdc6fbe047ff9935be78a8caf8_arm64, multicluster-engine/clusterclaims-controller-rhel9@sha256:a7359ae9df2701713f9c47a40cc2c377ef16e5fdc6fbe047ff9935be78a8caf8_arm64 |
| Red Hat | multicluster-engine/must-gather-rhel9@sha256:86e1331f8e2e7640852affe3800edcf59198d3f8ff90e1ad98e80d60cff2c296_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/must-gather-rhel9@sha256:86e1331f8e2e7640852affe3800edcf59198d3f8ff90e1ad98e80d60cff2c296_ppc64le, *, multicluster-engine/must-gather-rhel9@sha256:86e1331f8e2e7640852affe3800edcf59198d3f8ff90e1ad98e80d60cff2c296_ppc64le |
| Red Hat | multicluster-engine/assisted-image-service-rhel8@sha256:ed32227fb64e33622e8bd9022e18ec1ece3046663cadf7c8f34928df66b199b1_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8 | multicluster-engine/assisted-image-service-rhel8@sha256:ed32227fb64e33622e8bd9022e18ec1ece3046663cadf7c8f34928df66b199b1_amd64, *, multicluster-engine/assisted-image-service-rhel8@sha256:ed32227fb64e33622e8bd9022e18ec1ece3046663cadf7c8f34928df66b199b1_amd64 |
| Red Hat | multicluster-engine/cluster-api-provider-agent-rhel9@sha256:30fba8a5eb64152f13b39cde23469286b12d057e47f11bc3caecb1ee4022b16e_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/cluster-api-provider-agent-rhel9@sha256:30fba8a5eb64152f13b39cde23469286b12d057e47f11bc3caecb1ee4022b16e_ppc64le, multicluster-engine/cluster-api-provider-agent-rhel9@sha256:30fba8a5eb64152f13b39cde23469286b12d057e47f11bc3caecb1ee4022b16e_ppc64le, multicluster-engine/cluster-api-provider-agent-rhel9@sha256:30fba8a5eb64152f13b39cde23469286b12d057e47f11bc3caecb1ee4022b16e_ppc64le |
| Red Hat | multicluster-engine/placement-rhel9@sha256:8c85b685999746eae96e928e75c41ea601b4edc48932a908d4a897aa0d702d91_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | *, multicluster-engine/placement-rhel9@sha256:8c85b685999746eae96e928e75c41ea601b4edc48932a908d4a897aa0d702d91_s390x, multicluster-engine/placement-rhel9@sha256:8c85b685999746eae96e928e75c41ea601b4edc48932a908d4a897aa0d702d91_s390x |
| Red Hat | multicluster-engine/assisted-image-service-rhel8@sha256:ec3ad28913a33188531ce868bafcdf3acb6d2d7745e45cfa6821993e212d8e8c_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8 | multicluster-engine/assisted-image-service-rhel8@sha256:ec3ad28913a33188531ce868bafcdf3acb6d2d7745e45cfa6821993e212d8e8c_arm64, multicluster-engine/assisted-image-service-rhel8@sha256:ec3ad28913a33188531ce868bafcdf3acb6d2d7745e45cfa6821993e212d8e8c_arm64, * |
| Red Hat | multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:cb44f2f973b809416800acd83911d6e70c45140fe7015f071aa8ddccfd544969_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9 | multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:cb44f2f973b809416800acd83911d6e70c45140fe7015f071aa8ddccfd544969_amd64, multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:cb44f2f973b809416800acd83911d6e70c45140fe7015f071aa8ddccfd544969_amd64, * |
…and 260 more
Timeline
- May 7, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:4605 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://issues.redhat.com/browse/ACM-18107 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4605.json advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
- https://go.dev/cl/652155 advisory
- https://go.dev/issue/71490 advisory
- https://pkg.go.dev/vuln/GO-2025-3488 advisory