Resource exhaustion in oauth2 - CVE-2025-22868

Vulnerability identifier: #VU105461

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-22868

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the jws package does not properly control consumption of internal resources when handling malformed tokens. A remote attacker can pass a malformed JWT token to the application, trigger resource exhaustion and perform a denial of service (DoS) attack.

oauth2
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Fedora
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Public Cloud Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Basesystem Module
HPC Module
SUSE Package Hub 15
Containers Module
openSUSE Leap
VolSync
IBM Concert Software
Netcool Operations Insight
IBM Cloud Pak for Security
IBM Fusion HCI
OpenShift Logging
IBM Automation Decision Services
IBM Cloud Pak for Business Automation
Submariner
IBM Observability with Instana
Multicluster GlobalHub
Traefik
Red Hat Advanced Cluster Management for Kubernetes
Splunk Operator for Kubernetes Add-on
APEX Cloud Platform for Red Hat OpenShift
AI Inference Server Model Optimization Tools
AI Inference Server
Red Hat OpenShift Dev Spaces
Cryostat
Red Hat Advanced Cluster Security for Kubernetes
Db2 Intelligence Center
Financial Transaction Manager for RedHat OpenShift
Guardium Data Security Center (GDSC)
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Storage Ceph
Robotic Process Automation for Cloud Pak
Business Automation Insights
QRadar Suite
Splunk Enterprise
watsonx.data
Financial Transaction Manager
Cloud Pak for Data
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
golang-x-perf
govulncheck-vulndb
restic
opentelemetry-collector (Red Hat package)
rekor-debuginfo
rekor
opentofu
grpcurl
rclone
cosign
cosign-debuginfo
cosign-bash-completion
cosign-fish-completion
cosign-zsh-completion
ignition-dracut-grub2
ignition-debuginfo
ignition
golang-github-prometheus
google-cloud-sap-agent
docker-stable-bash-completion
docker-stable-debuginfo
docker-stable
docker-stable-rootless-extras
docker-stable-zsh-completion
docker-stable-fish-completion
docker-debuginfo
docker
docker-bash-completion
docker-zsh-completion
docker-fish-completion
docker-rootless-extras
google-osconfig-agent
google-guest-agent
OpenShift API for Data Protection (OADP)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat Ceph Storage

Install updates from vendor's website.

oauth2 - update to 0.27.0
VolSync - update to 0.12.1
IBM Concert Software - update to 2.0.0
Db2 Intelligence Center - update to 1.1.2.0
Netcool Operations Insight - update to 1.6.15
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
watsonx.data - update to 2.2.1
IBM Fusion HCI - update to 2.10.0
Guardium Data Security Center (GDSC) - update to 3.7.2
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
Cloud Pak for Data - update to 5.2.0
Storage Ceph - update to 8.1z2
OpenShift Logging - addressed in versions 6.0.12, 6.2.7
Splunk Enterprise - addressed in versions 9.3.10, 9.4.9, 10.0.4, 10.2.1
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.4, 30.0.0.1
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF007, 24.0.1-IF006, 25.0.0-IF003
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
golang-x-perf - update to 0-0.28.20250326git02a15fd.fc41
govulncheck-vulndb - update to 0.0.20250226T025151-150000.1.35.1
Submariner - addressed in versions 0.17.6, 0.18.5, 0.19.4
restic - update to 0.18.0-1.fc43
opentelemetry-collector (Red Hat package) - update to 0.107.0-7.el9_4
IBM Observability with Instana - update to 1.0.295
Multicluster GlobalHub - addressed in versions 1.2.2, 1.3.3
OpenShift API for Data Protection (OADP) - addressed in versions 1.3.7, 1.4.5
rekor-debuginfo - update to 1.3.10-150400.4.25.1
rekor - update to 1.3.10-150400.4.25.1
Migration Toolkit for Containers - update to 1.8.7
opentofu - addressed in versions 1.9.1-1.fc43, 1.10.3-1.el9
grpcurl - update to 1.9.3-1.fc43
rclone - addressed in versions 1.70.2-1.fc43, 1.70.3-1.el9
Multicluster Engine for Kubernetes - addressed in versions 2.4.9, 2.5.9, 2.6.7, 2.7.4, 2.8.1
cosign - update to 2.5.0-150400.3.27.1
cosign-debuginfo - update to 2.5.0-150400.3.27.1
cosign-bash-completion - update to 2.5.0-150400.3.27.1
cosign-fish-completion - update to 2.5.0-150400.3.27.1
cosign-zsh-completion - update to 2.5.0-150400.3.27.1
Traefik - addressed in versions 2.11.24, 3.3.6
Red Hat Advanced Cluster Management for Kubernetes - update to 2.12.3
ignition-dracut-grub2 - addressed in versions 2.14.0-150300.4.13.1, 2.14.0-150300.6.13.1, 2.14.0-150400.4.9.1, 2.14.0-150400.9.9.1, 2.15.0-150400.4.11.1
ignition-debuginfo - addressed in versions 2.14.0-150300.4.13.1, 2.14.0-150300.6.13.1, 2.14.0-150400.4.9.1, 2.14.0-150400.9.9.1, 2.15.0-150400.4.11.1
ignition - addressed in versions 2.14.0-150300.4.13.1, 2.14.0-150300.6.13.1, 2.14.0-150400.4.9.1, 2.14.0-150400.9.9.1, 2.15.0-150400.4.11.1
golang-github-prometheus - update to 2.55.1-1.fc43
Splunk Operator for Kubernetes Add-on - update to 3.0.0
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
AI Inference Server Model Optimization Tools - update to 3.2.5
AI Inference Server - update to 3.2.5
google-cloud-sap-agent - addressed in versions 3.6-6.43.1, 3.6-150100.3.44.1
Red Hat OpenShift Dev Spaces - update to 3.20.0
Cryostat - update to 4.0.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4, 4.15.14, 4.18.3
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.5.7, 4.5.8, 4.6.3, 4.6.4
Red Hat OpenShift Container Platform - addressed in versions 4.12.79, 4.14.54, 4.15.49, 4.15.55, 4.16.44, 4.17.32, 4.18.14, 4.18.16, 4.19.0
Red Hat Ceph Storage - addressed in versions 7.1, 8.1
docker-stable-bash-completion - addressed in versions 24.0.9_ce-1.11.1, 24.0.9_ce-1.32.1, 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable-debuginfo - addressed in versions 24.0.9_ce-1.11.1, 24.0.9_ce-1.32.1, 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable - addressed in versions 24.0.9_ce-1.11.1, 24.0.9_ce-1.32.1, 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable-rootless-extras - addressed in versions 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable-zsh-completion - addressed in versions 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable-fish-completion - addressed in versions 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-debuginfo - addressed in versions 27.5.1_ce-98.126.1, 27.5.1_ce-150000.218.1
docker - addressed in versions 27.5.1_ce-98.126.1, 27.5.1_ce-150000.218.1
docker-bash-completion - addressed in versions 27.5.1_ce-98.126.1, 27.5.1_ce-150000.218.1
docker-zsh-completion - update to 27.5.1_ce-150000.218.1
docker-fish-completion - update to 27.5.1_ce-150000.218.1
docker-rootless-extras - update to 27.5.1_ce-150000.218.1
google-osconfig-agent - addressed in versions 20250115.01-1.38.1, 20250115.01-150000.1.47.1
google-guest-agent - addressed in versions 20250116.00-1.47.2, 20250116.00-150000.1.57.1

• https://go.dev/cl/652155
• https://go.dev/issue/71490
• https://pkg.go.dev/vuln/GO-2025-3488

• Denial of service in Go oauth2 jwt package
• SUSE update for govulncheck-vulndb
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.5
• SUSE update for google-osconfig-agent
• SUSE update for google-guest-agent
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.6
• SUSE update for google-cloud-sap-agent
• SUSE update for google-cloud-sap-agent
• SUSE update for google-guest-agent
• SUSE update for google-osconfig-agent
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.6
• Multiple vulnerabilities in Multicluster GlobalHub 1.2
• Multiple vulnerabilities in Red Hat build of Cryostat 4 on RHEL 9
• Multiple vulnerabilities in VolSync
• SUSE update for docker, docker-stable
• SUSE update for docker, docker-stable
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.8
• Multiple vulnerabilities in Multicluster GlobalHub 1.3
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• SUSE update for rekor
• SUSE update for cosign
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Multiple vulnerabilities in Submariner 0.19
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.5
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Submariner 0.18
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.18
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.4
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.15
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• Fedora 41 update for golang-x-perf
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• SUSE update for ignition
• SUSE update for ignition
• SUSE update for ignition
• SUSE update for ignition
• SUSE update for ignition
• Fedora 43 update for opentofu
• Multiple vulnerabilities in Submariner 0.17
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Fedora 43 update for rclone
• Red Hat Enterprise Linux 9 update for opentelemetry-collector
• Fedora 43 update for restic
• Fedora 43 update for golang-github-prometheus
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.4
• Fedora 43 update for grpcurl
• Resource exhaustion in IBM watsonx Orchestrate with watsonx Assistant Cartridge – UAB Component
• Resource exhaustion in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Fedora EPEL 9 update for opentofu
• Fedora EPEL 9 update for rclone
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• IBM Financial Transaction Manager (FTM) for RedHat OpenShift update for Go
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Concert Software
• Resource exhaustion in IBM watsonx.data
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in IBM Db2 Intelligence Center
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Splunk Operator for Kubernetes Add-on update for third-party components
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in Red Hat AI Inference Server Model Optimization Tools
• Multiple vulnerabilities in Red Hat AI Inference Server (TPU)
• Multiple vulnerabilities in Red Hat AI Inference Server (CUDA)
• Multiple vulnerabilities in Red Hat AI Inference Server (ROCm)
• Multiple vulnerabilities in Red Hat AI Inference Server (ROCm)
• Multiple vulnerabilities in Red Hat OpenShift Logging 6.2
• Multiple vulnerabilities in Red Hat OpenShift Logging 6.0
• IBM Storage Ceph update for Golang
• IBM Cloud Pak for Data System update for golang.org/x/oauth2 module
• Multiple vulnerabilities in Splunk Enterprise
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• SUSE update for docker-stable
• SUSE update for docker-stable
• Traefik update for Google oauth2