VDB
RHSA-2025%3A8390
RHSA-2025%3A8390
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | multicluster-engine/clusterlifecycle-state-metrics-rhel8@sha256:7e7a0356ce31dcf940ea5f091d373909b0aa626e63b337036162204cdbf0f6c1_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/clusterlifecycle-state-metrics-rhel8@sha256:7e7a0356ce31dcf940ea5f091d373909b0aa626e63b337036162204cdbf0f6c1_s390x, multicluster-engine/clusterlifecycle-state-metrics-rhel8@sha256:7e7a0356ce31dcf940ea5f091d373909b0aa626e63b337036162204cdbf0f6c1_s390x, multicluster-engine/clusterlifecycle-state-metrics-rhel8@sha256:7e7a0356ce31dcf940ea5f091d373909b0aa626e63b337036162204cdbf0f6c1_s390x |
| Red Hat | multicluster-engine/kube-rbac-proxy-mce-rhel8@sha256:8a0aee91d361bda86104aa22c4b6afbaf14d7b26649b67a78d2e77e1d591a8c3_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/kube-rbac-proxy-mce-rhel8@sha256:8a0aee91d361bda86104aa22c4b6afbaf14d7b26649b67a78d2e77e1d591a8c3_ppc64le, multicluster-engine/kube-rbac-proxy-mce-rhel8@sha256:8a0aee91d361bda86104aa22c4b6afbaf14d7b26649b67a78d2e77e1d591a8c3_ppc64le, multicluster-engine/kube-rbac-proxy-mce-rhel8@sha256:8a0aee91d361bda86104aa22c4b6afbaf14d7b26649b67a78d2e77e1d591a8c3_ppc64le |
| Red Hat | multicluster-engine/placement-rhel8@sha256:11deb18370c60259cbe895cbc86a0e0c20a8f36849d8206dc14e97f426df5c25_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | *, multicluster-engine/placement-rhel8@sha256:11deb18370c60259cbe895cbc86a0e0c20a8f36849d8206dc14e97f426df5c25_s390x, * |
| Red Hat | multicluster-engine/aws-encryption-provider-rhel8@sha256:ebcf3121463cf43ef105fbd7eaea30b48a275bfd7844c4dadf39a78d7ae8ab99_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | *, *, multicluster-engine/aws-encryption-provider-rhel8@sha256:ebcf3121463cf43ef105fbd7eaea30b48a275bfd7844c4dadf39a78d7ae8ab99_amd64 |
| Red Hat | multicluster-engine/discovery-rhel8@sha256:236cc96f1bc74976d4988617673e50a52bf6b4a39f73c8e1ed3f50e10d5064f1_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/discovery-rhel8@sha256:236cc96f1bc74976d4988617673e50a52bf6b4a39f73c8e1ed3f50e10d5064f1_arm64, multicluster-engine/discovery-rhel8@sha256:236cc96f1bc74976d4988617673e50a52bf6b4a39f73c8e1ed3f50e10d5064f1_arm64, * |
| Red Hat | multicluster-engine/cluster-proxy-rhel8@sha256:8adbc1d9813d7633ec16a34f6d3004b93dc878f7a2b36191ed5cd6d09bf53500_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/cluster-proxy-rhel8@sha256:8adbc1d9813d7633ec16a34f6d3004b93dc878f7a2b36191ed5cd6d09bf53500_amd64, multicluster-engine/cluster-proxy-rhel8@sha256:8adbc1d9813d7633ec16a34f6d3004b93dc878f7a2b36191ed5cd6d09bf53500_amd64, multicluster-engine/cluster-proxy-rhel8@sha256:8adbc1d9813d7633ec16a34f6d3004b93dc878f7a2b36191ed5cd6d09bf53500_amd64 |
| Red Hat | multicluster-engine/clusterlifecycle-state-metrics-rhel8@sha256:7e7a0356ce31dcf940ea5f091d373909b0aa626e63b337036162204cdbf0f6c1_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | *, *, * |
| Red Hat | multicluster-engine/clusterclaims-controller-rhel8@sha256:24267377a867d1777e977c94a6dbb729ecd769434f5956beeb7ab9476977fe0f_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/clusterclaims-controller-rhel8@sha256:24267377a867d1777e977c94a6dbb729ecd769434f5956beeb7ab9476977fe0f_s390x, *, multicluster-engine/clusterclaims-controller-rhel8@sha256:24267377a867d1777e977c94a6dbb729ecd769434f5956beeb7ab9476977fe0f_s390x |
| Red Hat | multicluster-engine/managedcluster-import-controller-rhel8@sha256:ca6ad353fee5e55dbf9ad60cd64b276704d8882fcdcd04a9201a9b3cae824e32_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | *, multicluster-engine/managedcluster-import-controller-rhel8@sha256:ca6ad353fee5e55dbf9ad60cd64b276704d8882fcdcd04a9201a9b3cae824e32_amd64, multicluster-engine/managedcluster-import-controller-rhel8@sha256:ca6ad353fee5e55dbf9ad60cd64b276704d8882fcdcd04a9201a9b3cae824e32_amd64 |
| Red Hat | multicluster-engine/cluster-api-provider-kubevirt-rhel8@sha256:2c3e43aef7f918467b7be77161f5bebb5134128fdd3e9315e05559fe85262539_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/cluster-api-provider-kubevirt-rhel8@sha256:2c3e43aef7f918467b7be77161f5bebb5134128fdd3e9315e05559fe85262539_s390x, multicluster-engine/cluster-api-provider-kubevirt-rhel8@sha256:2c3e43aef7f918467b7be77161f5bebb5134128fdd3e9315e05559fe85262539_s390x, * |
| Red Hat | multicluster-engine/console-mce-rhel8@sha256:eb1fe8f8828ea37fe432978ffcad25150e938aa3b7ac945f316c523a6a783e4b_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | *, multicluster-engine/console-mce-rhel8@sha256:eb1fe8f8828ea37fe432978ffcad25150e938aa3b7ac945f316c523a6a783e4b_arm64, * |
| Red Hat | multicluster-engine/mce-operator-bundle@sha256:cb9739d1ca6bb93329f2b880013f3ceb68f765ed7f752b95f9450cdf0567e0f6_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/mce-operator-bundle@sha256:cb9739d1ca6bb93329f2b880013f3ceb68f765ed7f752b95f9450cdf0567e0f6_s390x, multicluster-engine/mce-operator-bundle@sha256:cb9739d1ca6bb93329f2b880013f3ceb68f765ed7f752b95f9450cdf0567e0f6_s390x, * |
| Red Hat | multicluster-engine/cluster-image-set-controller-rhel8@sha256:20884fcf57f4d245e335783f1674321d8c0dd195094e5f7d55abe24e63fc119f_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/cluster-image-set-controller-rhel8@sha256:20884fcf57f4d245e335783f1674321d8c0dd195094e5f7d55abe24e63fc119f_s390x, multicluster-engine/cluster-image-set-controller-rhel8@sha256:20884fcf57f4d245e335783f1674321d8c0dd195094e5f7d55abe24e63fc119f_s390x, multicluster-engine/cluster-image-set-controller-rhel8@sha256:20884fcf57f4d245e335783f1674321d8c0dd195094e5f7d55abe24e63fc119f_s390x |
| Red Hat | multicluster-engine/multicloud-manager-rhel8@sha256:cea8cb9c2e54a1f813a9e2d28ab2f200c1f8e2450c6ae9f3494d6443eff08496_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | *, *, multicluster-engine/multicloud-manager-rhel8@sha256:cea8cb9c2e54a1f813a9e2d28ab2f200c1f8e2450c6ae9f3494d6443eff08496_s390x |
| Red Hat | multicluster-engine/agent-service-rhel8@sha256:acf3a8e86b71ab43cf678514f94043bceed7a1a6b82bf4d9894406015c7b4853_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | *, multicluster-engine/agent-service-rhel8@sha256:acf3a8e86b71ab43cf678514f94043bceed7a1a6b82bf4d9894406015c7b4853_arm64, multicluster-engine/agent-service-rhel8@sha256:acf3a8e86b71ab43cf678514f94043bceed7a1a6b82bf4d9894406015c7b4853_arm64 |
| Red Hat | multicluster-engine/cluster-proxy-rhel8@sha256:d222116aad0e4cfe7719834d03dfe8f4bdcbb2754d02bcbbc058bfd572414df2_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/cluster-proxy-rhel8@sha256:d222116aad0e4cfe7719834d03dfe8f4bdcbb2754d02bcbbc058bfd572414df2_arm64, multicluster-engine/cluster-proxy-rhel8@sha256:d222116aad0e4cfe7719834d03dfe8f4bdcbb2754d02bcbbc058bfd572414df2_arm64, multicluster-engine/cluster-proxy-rhel8@sha256:d222116aad0e4cfe7719834d03dfe8f4bdcbb2754d02bcbbc058bfd572414df2_arm64 |
| Red Hat | multicluster-engine/cluster-api-provider-aws-rhel8@sha256:732c6b381a7c465480e89ae54fd1a8c4e03d61a1b83e0f0ef1a47d401a3a3efe_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/cluster-api-provider-aws-rhel8@sha256:732c6b381a7c465480e89ae54fd1a8c4e03d61a1b83e0f0ef1a47d401a3a3efe_amd64, *, multicluster-engine/cluster-api-provider-aws-rhel8@sha256:732c6b381a7c465480e89ae54fd1a8c4e03d61a1b83e0f0ef1a47d401a3a3efe_amd64 |
| Red Hat | multicluster-engine/assisted-image-service-rhel8@sha256:bb84d86217bea84259c9772ef2f6f28ab78a27b8a272338c6394017bcff8d58c_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | *, multicluster-engine/assisted-image-service-rhel8@sha256:bb84d86217bea84259c9772ef2f6f28ab78a27b8a272338c6394017bcff8d58c_ppc64le, multicluster-engine/assisted-image-service-rhel8@sha256:bb84d86217bea84259c9772ef2f6f28ab78a27b8a272338c6394017bcff8d58c_ppc64le |
| Red Hat | multicluster-engine/assisted-installer-rhel8@sha256:64a24602f8a0f72f138f89c25d1be762fed583cca3edd1f0eda65f96ed9f2010_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/assisted-installer-rhel8@sha256:64a24602f8a0f72f138f89c25d1be762fed583cca3edd1f0eda65f96ed9f2010_amd64, multicluster-engine/assisted-installer-rhel8@sha256:64a24602f8a0f72f138f89c25d1be762fed583cca3edd1f0eda65f96ed9f2010_amd64, multicluster-engine/assisted-installer-rhel8@sha256:64a24602f8a0f72f138f89c25d1be762fed583cca3edd1f0eda65f96ed9f2010_amd64 |
| Red Hat | multicluster-engine/cluster-curator-controller-rhel8@sha256:76452e62d464e9cf633ef066303cb1c706e32765a88eae9b5e6138fc8b1f02f8_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8 | multicluster-engine/cluster-curator-controller-rhel8@sha256:76452e62d464e9cf633ef066303cb1c706e32765a88eae9b5e6138fc8b1f02f8_ppc64le, *, multicluster-engine/cluster-curator-controller-rhel8@sha256:76452e62d464e9cf633ef066303cb1c706e32765a88eae9b5e6138fc8b1f02f8_ppc64le |
…and 261 more
Timeline
- Jun 2, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:8390 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://issues.redhat.com/browse/ACM-10166 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8390.json advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
- https://go.dev/cl/652155 advisory
- https://go.dev/issue/71490 advisory
- https://pkg.go.dev/vuln/GO-2025-3488 advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-30204 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-30204 advisory
- https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 advisory
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp advisory
- https://pkg.go.dev/vuln/GO-2025-3553 advisory