CVE-2025-22868: Unexpected memory consumption during token parsing in golang.org/x/oauth2

Analyzed

AliasesSUSE-SU-2025:02035-1SUSE-SU-2025:02040-1SUSE-SU-2025:02041-1+3521 more

Published 26-02-2025Last modified 26-02-2025

Vulnerability summary

CVE-2025-22868 is a high (CVSS 7.5) vulnerability in go jws. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58.8% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.87%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 46 · Related 930

OPENSUSE-SU-2025:0103-1 OPENSUSE-SU-2025:14839-1 OPENSUSE-SU-2025:14843-1 OPENSUSE-SU-2025:14923-1 OPENSUSE-SU-2025:14985-1 OPENSUSE-SU-2025:14988-1+94 more

Showing 100 of 930.

Timeline

26-02-2025
PublishedVulnerability first disclosed.
26-02-2025
Last modifiedVulnerability information updated.

Description

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.87%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.87% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-1286Improper Validation of Syntactic Correctness of InputThe product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

aactl< 0.4.12-r28
actions-runner-controller< 0.10.1-r5
actions-runner-controller-compat< 0.10.1-r5
actions-runner-controller-fips< 0.10.1-r5
actions-runner-controller-fips-compat< 0.10.1-r5

addon-resizer< 1.8.23-r2
addon-resizer-compat< 1.8.23-r2
addon-resizer-fips< 1.8.23-r2
addon-resizer-fips-compat< 1.8.23-r2
agentbeat-fips< 8.17.3-r2
amazon-cloudwatch-agent< 1.300053.0-r7
amazon-cloudwatch-agent-all< 1.300053.0-r7
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300053.0-r7
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300053.0-r6
amazon-cloudwatch-agent-compat< 1.300053.0-r7
amazon-cloudwatch-agent-config-downloader< 1.300053.0-r7
amazon-cloudwatch-agent-config-downloader-fips< 1.300053.0-r6
amazon-cloudwatch-agent-config-translator< 1.300053.0-r7
amazon-cloudwatch-agent-config-translator-fips< 1.300053.0-r6
amazon-cloudwatch-agent-fips< 1.300053.0-r6
amazon-cloudwatch-agent-operator< 2.2.0-r1
amazon-cloudwatch-agent-operator-compat< 2.2.0-r1
amazon-cloudwatch-agent-operator-fips< 2.2.0-r0
amazon-cloudwatch-agent-operator-fips-compat< 2.2.0-r0
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300053.0-r7
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300053.0-r6
amazon-k8s-cni< 1.19.3-r1
amazon-k8s-cni-compat< 1.19.3-r1
amazon-k8s-cni-init< 1.19.3-r1
amazon-k8s-cni-init-compat< 1.19.3-r1
amazon-ssm-agent< 3.3.1957.0-r4
amazon-ssm-agent-ecs-exec< 3.3.1957.0-r4
ansible-operator< 1.37.1-r6
ansible-operator-compat< 1.37.1-r6
apko< 0.25.5-r0
argo-cd-2.11< 2.11.13-r5
argo-cd-2.13< 2.13.5-r5
argo-cd-2.13-compat< 2.13.5-r5
argo-cd-2.13-repo-server< 2.13.5-r5
argo-cd-2.14< 2.14.7-r0
argo-cd-2.14-compat< 2.14.7-r0
argo-cd-2.14-repo-server< 2.14.7-r0
argo-cd-fips-2.14< 2.14.6-r0
argo-cd-fips-2.14-compat< 2.14.6-r0
argo-cd-fips-2.14-repo-server< 2.14.6-r0
argo-events< 1.9.5-r4
argo-events-fips< 1.9.5-r3
argo-rollouts< 1.8.0-r32
argo-rollouts-fips< 1.8.0-r3
argo-workflows< 3.6.5-r2
argo-workflows-fips< 3.6.5-r0
argocd-image-updater< 0.15.2-r7
argocd-image-updater-compat< 0.15.2-r7
argocd-image-updater-fips< 0.15.2-r5
atlantis< 0.33.0-r3
atlantis-fips< 0.33.0-r4
auditbeat-7< 7.17.28-r3
auditbeat-7-oci-entrypoint< 7.17.28-r3
auditbeat-fips-7< 7.17.28-r1
authservice< 1.0.4-r3
authservice-compat< 1.0.4-r3
authservice-fips< 1.0.4-r3
authservice-fips-compat< 1.0.4-r3
aws-application-networking-k8s< 1.1.0-r4
aws-application-networking-k8s-compat< 1.1.0-r4
aws-ebs-csi-driver< 1.52.1-r0
aws-efs-csi-driver< 2.1.6-r1
aws-efs-csi-driver-fips< 2.1.6-r1
aws-load-balancer-controller< 2.12.0-r1
aws-load-balancer-controller-compat< 2.12.0-r1
aws-network-policy-agent< 1.1.6-r3
aws-network-policy-agent-compat< 1.1.6-r3
aws-network-policy-agent-compat-fips< 1.1.6-r3
aws-network-policy-agent-fips< 1.1.6-r3
aws-privateca-issuer< 1.4.1-r1
aws-privateca-issuer-compat< 1.4.1-r1
aws-privateca-issuer-compat-fips< 1.4.1-r1
aws-privateca-issuer-fips< 1.4.1-r1
aws-s3-controller< 1.0.27-r31
azcopy< 10.28.0-r3
azcopy-fips< 10.28.0-r3
azure-aad-pod-identity-mic< 1.8.17-r18
azure-aad-pod-identity-nmi< 1.8.17-r18
azure-workload-identity-webhook< 1.5.0-r1
azure-workload-identity-webhook-compat< 1.5.0-r1
azuredisk-csi-1.28< 1.28.11-r10
azuredisk-csi-1.28-compat< 1.28.11-r10
azuredisk-csi-1.29< 1.29.12-r4
azuredisk-csi-1.29-compat< 1.29.12-r4
azuredisk-csi-1.30< 1.30.9-r1
azuredisk-csi-1.30-compat< 1.30.9-r1
azuredisk-csi-1.31< 1.31.5-r1
azuredisk-csi-1.31-compat< 1.31.5-r1
azuredisk-csi-fips-1.28< 1.28.11-r8
azuredisk-csi-fips-1.29< 1.29.12-r4
azuredisk-csi-fips-1.30< 1.30.9-r2
azuredisk-csi-fips-1.31< 1.31.5-r1
azurefile-csi-1.32< 1.32.1-r2
azurefile-csi-1.32-compat< 1.32.1-r2
bank-vaults< 1.20.4-r29
bank-vaults-fips< 1.20.4-r23
bank-vaults-template< 1.20.4-r29
bank-vaults-template-fips< 1.20.4-r23
beats-7< 7.17.28-r3
beats-fips-7< 7.17.28-r1
blob-csi-1.23< 1.23.11-r2
blob-csi-1.23-compat< 1.23.11-r2
blob-csi-1.25< 1.25.5-r2
blob-csi-1.25-compat< 1.25.5-r2
blob-csi-1.26< 1.26.2-r1
blob-csi-1.26-compat< 1.26.2-r1
blob-csi-fips-1.23< 1.23.11-r2
blob-csi-fips-1.23-compat< 1.23.11-r2
blob-csi-fips-1.24< 1.24.9-r2
blob-csi-fips-1.24-compat< 1.24.9-r2
blob-csi-fips-1.25< 1.25.5-r2
blob-csi-fips-1.25-compat< 1.25.5-r2
blob-csi-fips-1.26< 1.26.2-r2
blob-csi-fips-1.26-compat< 1.26.2-r2
cadvisor< 0.52.1-r3
cadvisor-compat< 0.52.1-r3
cadvisor-fips< 0.52.1-r1
calico-3.29< 3.29.2-r31
calico-apiserver-3.29< 3.29.2-r31
calico-apiserver-compat-3.29< 3.29.2-r31
calico-apiserver-fips-3.29< 3.29.2-r31
calico-app-policy-3.29< 3.29.2-r31
calico-app-policy-fips-3.29< 3.29.2-r31
calico-cni-3.29< 3.29.2-r31
calico-cni-compat-3.29< 3.29.2-r31
calico-cni-compat-fips-3.29< 3.29.2-r31
calico-cni-fips-3.29< 3.29.2-r31
calico-felix-3.29< 3.29.2-r31
calico-felix-fips-3.29< 3.29.2-r31
calico-fips-3.29< 3.29.2-r31
calico-key-cert-provisioner-3.29< 3.29.2-r31
calico-key-cert-provisioner-fips-3.29< 3.29.2-r31
calico-kube-controllers-3.29< 3.29.2-r31
calico-kube-controllers-fips-3.29< 3.29.2-r31
calico-node-3.29< 3.29.2-r31
calico-node-fips-3.29< 3.29.2-r31
calico-pod2daemon-3.29< 3.29.2-r31
calico-pod2daemon-fips-3.29< 3.29.2-r31
calico-pod2daemon-flexvol-compat-3.29< 3.29.2-r31
calico-typha-client-3.29< 3.29.2-r31
calico-typha-client-fips-3.29< 3.29.2-r31
calico-typhad-3.29< 3.29.2-r31
calico-typhad-fips-3.29< 3.29.2-r31
calicoctl-3.29< 3.29.2-r31
calicoctl-fips-3.29< 3.29.2-r31
cass-operator< 1.23.0-r4
cass-operator-compat< 1.23.0-r4
cass-operator-compat-fips< 1.23.0-r4
cass-operator-config< 1.23.0-r4
cass-operator-fips< 1.23.0-r4
cass-operator-fips-no-pvc-delete< 1.23.0-r4
cass-operator-fips-no-pvc-delete-compat< 1.23.0-r4
cert-exporter< 2.14.0-r8
cert-exporter-fips< 2.14.0-r7
cert-manager-cmctl< 2.1.1-r6
cert-manager-cmctl-fips< 2.1.1-r7
cert-manager-fips-1.17< 1.17.1-r4
cert-manager-istio-csr< 0.14.0-r4
cert-manager-istio-csr-compat< 0.14.0-r4
cert-manager-webhook-pdns< 2.5.2-r1
cert-manager-webhook-pdns-fips< 2.5.2-r2
certificate-transparency< 1.3.1-r4
certificate-transparency-fips< 1.3.1-r4
certificate-transparency-fips-trillian-ctserver< 1.3.1-r4
certificate-transparency-trillian-ctserver< 1.3.1-r4
chartmuseum< 0.16.2-r12
chartmuseum-fips< 0.16.2-r11
chezmoi< 2.60.1-r0
cilium-1.15< 1.15.19-r3 | < 1.15.14-r22
cilium-1.15-clustermesh-apiserver< 1.15.14-r22
cilium-1.15-container-init< 1.15.14-r22
cilium-1.15-container-init-compat< 1.15.14-r22
cilium-1.15-hubble-relay< 1.15.14-r22
cilium-1.15-iptables< 1.15.14-r22
cilium-1.15-operator-aws< 1.15.14-r22
cilium-1.15-operator-generic< 1.15.14-r22
cilium-1.16-operator-generic< 1.16.16-r0
cilium-1.17< 1.17.1-r22
cilium-1.17-clustermesh-apiserver< 1.17.1-r22
cilium-1.17-container-init< 1.17.1-r22
cilium-1.17-container-init-compat< 1.17.1-r22
cilium-1.17-hubble-relay< 1.17.1-r22
cilium-1.17-iptables< 1.17.1-r22
cilium-1.17-operator-aws< 1.17.1-r22
cilium-1.17-operator-generic< 1.17.1-r22
cilium-cli< 0.18.2-r2
cilium-fips-1.15< 1.15.14-r3
cilium-fips-1.15-clustermesh-apiserver< 1.15.14-r3
cilium-fips-1.15-container-init< 1.15.14-r3
cilium-fips-1.15-container-init-compat< 1.15.14-r3
cilium-fips-1.15-host-utils< 1.15.14-r3
cilium-fips-1.15-hubble-relay< 1.15.14-r3
cilium-fips-1.15-operator-aws< 1.15.14-r3
cilium-fips-1.15-operator-azure< 1.15.14-r3
cilium-fips-1.15-operator-generic< 1.15.14-r3

Show all 200

1 vendor · 200 products · Showing 200 of 2498

References

30 links

go.dev/cl/652155REPORTFIXWEBPatch
go.dev/issue/71490REPORTFIXWEBIssue TrackingPatch
pkg.go.dev/vuln/GO-2025-3488REPORTAdvisoryWEBThird Party Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502035-1/Advisory
bugzilla.suse.com/1239192REPORT
www.suse.com/security/cve/CVE-2025-22868WEB
www.suse.com/support/update/announcement/2025/suse-su-202502040-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502041-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502046-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502097-1/Advisory

Show all 30 references

www.suse.com/support/update/announcement/2025/suse-su-20250852-1/Advisory
bugzilla.suse.com/1239197REPORT
www.suse.com/support/update/announcement/2025/suse-su-20250872-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-20250881-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-20250882-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-20251005-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-20251006-1/Advisory
lists.opensuse.org/archives/…Advisory
bugzilla.suse.com/1239264REPORT
ubuntu.com/security/CVE-2025-22868REPORT
www.cve.org/CVERecord?id=CVE-2025-22868REPORT
go-review.googlesource.com/c/oauth2/+/652155REPORT
security-tracker.debian.org/tracker/CVE-2025-22868Advisory
nvd.nist.gov/vuln/detail/CVE-2025-22868AdvisoryOval
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory