> CVE-2025-27144

« BACK_TO_HOME
PUBLISHED
2025-02-24 23:15
MODIFIED
2025-02-24 23:15
EPSS (Prob. Exploit)
0.40%
Top 67.0%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-03-01 MSRC 🔗 2026-02-01

> DESCRIPTION

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Enterprise Linux 10
Version: 1.39.4
Red Hat - Red Hat Enterprise Linux 10
Version: 5.4.0
Red Hat - Red Hat Enterprise Linux 10
Version: 1.18.1
Red Hat - Red Hat Enterprise Linux 10
Version: 0.107.0
Red Hat - Red Hat Enterprise Linux 9
Version: 0.107.0
Red Hat - Red Hat Enterprise Linux 9
Version: 1.39.4
Red Hat - Red Hat Enterprise Linux 9
Version: 5.4.0
Red Hat - Red Hat Enterprise Linux 9
Version: 1.18.1
Red Hat - Red Hat Enterprise Linux 9.4 Extended Update Support
Version: 0.107.0
Red Hat - Red Hat OpenShift Container Platform 4.16
Red Hat - Red Hat OpenShift Container Platform 4.18
Red Hat - Red Hat OpenShift Container Platform 4.18
Version: 5.2.2
Red Hat - Red Hat OpenShift Container Platform 4.18
Version: 1.16.1
Red Hat - Red Hat OpenShift GitOps 1.15
Red Hat - Red Hat OpenShift Container Platform 4.19
Red Hat - Red Hat OpenShift distributed tracing 3.5.2
Red Hat - Red Hat Advanced Cluster Security 4.7
Red Hat - Red Hat OpenShift Container Platform 4.17
Version: 5.2.2
Red Hat - Red Hat OpenShift Container Platform 4.17
Version: 1.16.1
Red Hat - Red Hat OpenShift Container Platform 4.17
Red Hat - Red Hat OpenShift distributed tracing 3.6.1
Red Hat - OADP-1.4-RHEL-9
Red Hat - Red Hat Advanced Cluster Security 4.6
Red Hat - RHODF-4.17-RHEL-9
Red Hat - RHODF-4.18-RHEL-9
Red Hat - RHOL-5.9-RHEL-9
Red Hat - RHOL-6.0-RHEL-9
Red Hat - RHOL-6.1-RHEL-9
Red Hat - Custom Metric Autoscaler operator for Red Hat Openshift 2.15
Red Hat - Red Hat Trusted Artifact Signer 1.1

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.4.5 security and bug fix update
OpenShift API for Data Protection (OADP) 1.4.5 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS)...
Red Hat Security Advisory: OpenShift Container Platform 4.19.0 bug fix and security update
Red Hat OpenShift Container Platform release 4.19.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Ha...
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.6.0 release
Red Hat build of OpenTelemetry 3.6.0 has been released
Red Hat Security Advisory: OpenShift Container Platform 4.17.30 bug fix and security update
Red Hat OpenShift Container Platform release 4.17.30 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.7 Bug Fix Update
Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.17.7 on Red Hat Enterprise Linux 9 from Red Hat Container Registry.
Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.15.2 security update
Errata Advisory for Red Hat OpenShift GitOps 1.15.2 release
Red Hat Security Advisory: OpenShift Container Platform 4.18.13 bug fix and security update
Red Hat OpenShift Container Platform release 4.18.13 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: buildah security update
An update for buildah is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (...
Red Hat Security Advisory: skopeo security update
An update for skopeo is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (C...
Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
Red Hat Security Advisory: podman security update
An update for podman is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (...
Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
Red Hat Security Advisory: skopeo security update
An update for skopeo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CV...
Red Hat Security Advisory: podman security update
An update for podman is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (C...
Red Hat Security Advisory: buildah security update
An update for buildah is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (C...
Red Hat Security Advisory: OpenShift Container Platform 4.18.12 bug fix and security update
Red Hat OpenShift Container Platform release 4.18.12 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: RHODF-4.18-RHEL-9 security update
Updated images are now available for RHODF-4.18-RHEL-9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base scor...
Red Hat Security Advisory: OpenShift Container Platform 4.18.11 bug fix and security update
Red Hat OpenShift Container Platform release 4.18.11 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
The 1.1.2 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details see [product documentation](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1).
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.5.1 release
Red Hat build of OpenTelemetry 3.5.1 has been released
Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Importan...
Red Hat Security Advisory: OpenShift Container Platform 4.16.38 bug fix and security update
Red Hat OpenShift Container Platform release 4.16.38 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.15.1-4 Update
Custom Metrics Autoscaler Operator for Red Hat OpenShift updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: * custom-metrics-autoscaler-a...
Red Hat Security Advisory: ACS 4.6 enhancement and security update
Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes security and bug fixes. Red Hat Product Security has rated this update as hav...
Red Hat Security Advisory: ACS 4.7 enhancement and security update
Updated images are now available for Red Hat Advanced Cluster Security (RHACS).
Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
Red Hat Security Advisory: OpenShift Container Platform 4.17.22 packages and security update
Red Hat OpenShift Container Platform release 4.17.22 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.1.4
Logging for Red Hat OpenShift - 6.1.4
Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.6
Logging for Red Hat OpenShift - 6.0.6
Red Hat Security Advisory: OpenShift Container Platform 4.18.6 packages and security update
Red Hat OpenShift Container Platform release 4.18.6 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Ha...
Red Hat Security Advisory: OpenShift Container Platform 4.18.6 bug fix and security update
Red Hat OpenShift Container Platform release 4.18.6 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Ha...
Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...
Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.2
cert-manager Operator for Red Hat OpenShift 1.15.2
Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update
Red Hat Advanced Cluster Management for Kubernetes 2.12 General Availability release images, which add new features and enhancements, bug fixes, and updated container images.
Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.5 security update
Red Hat Advanced Cluster Management for Kubernetes 2.13 General Availability release images, which add new features and enhancements, bug fixes, and updated container images.
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4
The 1.15.4 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Moderate

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Go JOSE's Parsing Vulnerable to Denial of Service

AFFECTED PACKAGES:
Unknown / Unknown
5 versions affected
ALIASES:
GHSA-c6gw-w398-hv78, GO-2025-3485

> HISTORIQUE DES MODIFICATIONS

Première apparition
24/02/2025 23:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:01
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:24
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Moderate", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:24
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME