CVE-2025-27144
Description
A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of . characters. This issue could be exploied by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.
Statement
A moderate-impact denial of service flaw was found in Go JOSE, the Go implementation of the JSON Object Signing and Encryption (JOSE) standards, which is shipped in a number of Red Hat offerings including Red Hat OpenShift and related container-based products. When parsing compact JWS or JWE input, Go JOSE used strings.Split(token, ".") to split tokens, which can consume excessive memory when processing maliciously crafted tokens containing a large number of "." characters. A remote attacker with no privileges or required user interaction could submit numerous malformed tokens to an application that passes attacker-controlled input to Go JOSE, causing memory exhaustion and a denial of service that affects only availability. Red Hat rates this issue as moderate impact, consistent with the upstream severity assessment. Fixes are being pursued by the affected product components; some components were determined not to be affected because the vulnerable code is not present or is not in an execute path.
Mitigation
As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
