CVE-2025-27144
ADVISORY - githubSummary
Impact
When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.
Patches
Version 4.0.5 fixes this issue
Workarounds
Applications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters.
References
This is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.
Common Weakness Enumeration (CWE)
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling
NIST
-
CVSS SCORE
6.6mediumGitHub
CVSS SCORE
6.9mediumDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumGoLang
-
Alma
-
CVSS SCORE
N/AmediumAlma
-
CVSS SCORE
N/AmediumAmazon
-
CVSS SCORE
N/AmediumAmazon
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AmediumAmazon
-
CVSS SCORE
N/AmediumRed Hat
3.9
CVSS SCORE
7.5mediumRocky
-
CVSS SCORE
N/AlowRocky
-
CVSS SCORE
N/AhighRocky
-
CVSS SCORE
N/AlowRocky
-
CVSS SCORE
N/AlowRocky
-
CVSS SCORE
N/AhighRocky
-
CVSS SCORE
N/AlowRocky
-
CVSS SCORE
N/AhighOracle
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AhighOracle
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AhighOracle
-
CVSS SCORE
N/AmediumChainguard
CGA-229g-gxp4-pxjc
-
Chainguard
CGA-22ff-3g6h-g56h
-
Chainguard
CGA-25v8-g6jj-9g2g
-
Chainguard
CGA-2655-vvqj-686c
-
Chainguard
CGA-267w-rw4h-6pm2
-
Chainguard
CGA-27vx-g344-gx55
-
Chainguard
CGA-2g49-7fhf-9hgm
-
Chainguard
CGA-2gc4-jj2v-mhc6
-
Chainguard
CGA-2hp4-vhgf-fqf5
-
Chainguard
CGA-2j6h-xvr5-gccr
-
Chainguard
CGA-2jfh-m9v3-55ww
-
Chainguard
CGA-2rwf-9w3g-rc88
-
Chainguard
CGA-2xh4-rpqj-8hv4
-
Chainguard
CGA-2xmw-87r3-2242
-
Chainguard
CGA-33j3-fhjr-9h56
-
Chainguard
CGA-36jx-qqr9-c6r2
-
Chainguard
CGA-38vj-rjrq-fmww
-
Chainguard
CGA-3c4h-2wmj-g233
-
Chainguard
CGA-3j92-f7g3-jc9q
-
Chainguard
CGA-3qj2-673g-jfrr
-
Chainguard
CGA-3qw8-c55g-q69p
-
Chainguard
CGA-3r67-84xp-jv3q
-
Chainguard
CGA-3vjc-9jm2-q56g
-
Chainguard
CGA-3vr9-rg2q-826f
-
Chainguard
CGA-3w32-3mxx-gvgj
-
Chainguard
CGA-42r3-4qww-g45m
-
Chainguard
CGA-446m-9w9j-x6h8
-
Chainguard
CGA-45pg-gv9v-4245
-
Chainguard
CGA-45wm-3hmp-4v2w
-
Chainguard
CGA-46m8-qh5q-qjrr
-
Chainguard
CGA-47cc-4jcx-6r8v
-
Chainguard
CGA-48q6-xch5-4gcf
-
Chainguard
CGA-492h-mch2-329g
-
Chainguard
CGA-49v4-5xpp-rm5h
-
Chainguard
CGA-4cwr-jh4g-vrxj
-
Chainguard
CGA-4fwq-wq2r-crq4
-
Chainguard
CGA-4m2j-q3q7-62jf
-
Chainguard
CGA-4q3h-chf9-wj89
-
Chainguard
CGA-4vxp-w99c-6w93
-
Chainguard
CGA-547w-6r7c-34f4
-
Chainguard
CGA-54g5-hc99-4q3r
-
Chainguard
CGA-54ph-m23q-fm45
-
Chainguard
CGA-55rm-rp5h-79jp
-
Chainguard
CGA-56h7-qgr2-2852
-
Chainguard
CGA-56j3-f74p-xm4f
-
Chainguard
CGA-57qj-m42w-x8vm
-
Chainguard
CGA-5823-8435-m4qx
-
Chainguard
CGA-58v2-9jmg-jgf7
-
Chainguard
CGA-594g-gh8c-qmf9
-
Chainguard
CGA-59q4-595c-3c7c
-
Chainguard
CGA-5cq5-x9jg-2m2v
-
Chainguard
CGA-5hcx-6mq6-w89g
-
Chainguard
CGA-5jxw-f8jg-7mxm
-
Chainguard
CGA-5qc6-jx47-5rm4
-
Chainguard
CGA-5rrw-5rm2-3p8j
-
Chainguard
CGA-5v2r-ffgm-p77q
-
Chainguard
CGA-5vc3-q256-jcwj
-
Chainguard
CGA-5vg7-fg65-g432
-
Chainguard
CGA-63gv-h3mh-cj93
-
Chainguard
CGA-63j4-8r55-j68q
-
Chainguard
CGA-648p-xrf2-2hg4
-
Chainguard
CGA-65jv-6f3g-c7h3
-
Chainguard
CGA-674x-7w4g-xhr5
-
Chainguard
CGA-6g5x-cr9c-j9q8
-
Chainguard
CGA-6g93-mgq4-fq3f
-
Chainguard
CGA-6jjc-jjc5-xqjc
-
Chainguard
CGA-732j-w5hj-jq29
-
Chainguard
CGA-74w9-h8g9-g2p6
-
Chainguard
CGA-75j2-97j7-3cfm
-
Chainguard
CGA-75qc-373w-qm5r
-
Chainguard
CGA-77hx-x9cc-8vc9
-
Chainguard
CGA-78x7-gjg9-fccr
-
Chainguard
CGA-7cf6-pm8c-f87x
-
Chainguard
CGA-7hf3-mj2w-rx7m
-
Chainguard
CGA-7p29-gmq3-hwg7
-
Chainguard
CGA-7qx6-qpqv-j52c
-
Chainguard
CGA-7rjr-5359-xrr7
-
Chainguard
CGA-7w54-585x-8vcx
-
Chainguard
CGA-7wj3-fw8p-7qg2
-
Chainguard
CGA-7wj8-vrc7-7ch6
-
Chainguard
CGA-82ff-77q7-6vj3
-
Chainguard
CGA-83qh-6mgw-hq87
-
Chainguard
CGA-85mh-538m-5h7r
-
Chainguard
CGA-87vm-g898-763f
-
Chainguard
CGA-89hh-8cmh-c3rw
-
Chainguard
CGA-89hw-x2ph-wj6c
-
Chainguard
CGA-89rv-fgm7-33vw
-
Chainguard
CGA-89wr-239h-8679
-
Chainguard
CGA-8fw2-rmfg-7f53
-
Chainguard
CGA-8h2g-53r5-hmmv
-
Chainguard
CGA-8pvx-w692-7qf3
-
Chainguard
CGA-8wcv-h9cw-jc57
-
Chainguard
CGA-92p5-wv75-xw3p
-
Chainguard
CGA-95g4-63f8-w9c5
-
Chainguard
CGA-96qp-63gq-cqfx
-
Chainguard
CGA-9727-2cp4-w9w4
-
Chainguard
CGA-9hf6-wfcx-h396
-
Chainguard
CGA-9m36-43g4-v5g4
-
Chainguard
CGA-9v3p-6mj3-3983
-
Chainguard
CGA-9vj2-376j-m922
-
Chainguard
CGA-9wmf-r8m6-frxf
-
Chainguard
CGA-9xpf-xgvq-g599
-
Chainguard
CGA-c3g3-624g-5pqh
-
Chainguard
CGA-c43w-q43h-rwmj
-
Chainguard
CGA-c52r-g432-pw2p
-
Chainguard
CGA-cfxp-pf9h-c4xp
-
Chainguard
CGA-cj5x-wjrc-wrv4
-
Chainguard
CGA-cq87-ppq6-jcpc
-
Chainguard
CGA-cr4r-m482-5mmx
-
Chainguard
CGA-cr9p-qj6v-3f48
-
Chainguard
CGA-f27q-67hv-27v9
-
Chainguard
CGA-f37v-m3vv-pqgv
-
Chainguard
CGA-f4mv-vc4f-mx64
-
Chainguard
CGA-f5qg-qvcf-f979
-
Chainguard
CGA-f826-g694-6r52
-
Chainguard
CGA-f8cc-vq8g-3ggp
-
Chainguard
CGA-f9h2-qcf9-qwcv
-
Chainguard
CGA-f9wx-q784-hjff
-
Chainguard
CGA-ffw3-hm7r-qg7v
-
Chainguard
CGA-fhxp-jj9v-5r2c
-
Chainguard
CGA-fj6x-c83v-fwfp
-
Chainguard
CGA-fm4h-m69p-33fr
-
Chainguard
CGA-fmp6-p5ww-7j8p
-
Chainguard
CGA-fmqj-q6j3-mcqx
-
Chainguard
CGA-fr5g-jj8q-rfwc
-
Chainguard
CGA-fvf7-86mq-r9wm
-
Chainguard
CGA-fvg2-c3ww-xhmm
-
Chainguard
CGA-fvp6-7fgp-52w9
-
Chainguard
CGA-fx9m-2xwh-w89f
-
Chainguard
CGA-g33c-w924-q678
-
Chainguard
CGA-g3cp-wrjj-cq72
-
Chainguard
CGA-g47m-p6pq-g525
-
Chainguard
CGA-g47x-pqv4-w4h8
-
Chainguard
CGA-g5f2-8r6g-xxgj
-
Chainguard
CGA-g78c-5chg-xfc7
-
Chainguard
CGA-g934-v2f3-cxpv
-
Chainguard
CGA-g9x6-c4gh-5cgf
-
Chainguard
CGA-gg6w-m6fh-g8rw
-
Chainguard
CGA-gjrg-p97h-8rq8
-
Chainguard
CGA-gvgx-gw4w-qjpv
-
Chainguard
CGA-h2r4-7jrj-fjwv
-
Chainguard
CGA-h45w-f3jv-8mfv
-
Chainguard
CGA-h4wf-xx75-qc4w
-
Chainguard
CGA-h5mq-8m6c-58cj
-
Chainguard
CGA-h63x-c649-7g74
-
Chainguard
CGA-h66x-hpx9-mr95
-
Chainguard
CGA-h8qr-hcg5-c5mq
-
Chainguard
CGA-hhgr-8j34-f9cx
-
Chainguard
CGA-hhqj-22f5-5p5j
-
Chainguard
CGA-hj9h-hmr3-xvgr
-
Chainguard
CGA-hm3v-4q5m-4rhw
-
Chainguard
CGA-hmh8-cwmv-q5cm
-
Chainguard
CGA-hmjh-wr82-gg8p
-
Chainguard
CGA-hp7j-6qvc-9q99
-
Chainguard
CGA-hv7j-97pw-cvqj
-
Chainguard
CGA-hwqr-f8mp-v8m6
-
Chainguard
CGA-hwqr-q8gq-qmc4
-
Chainguard
CGA-j264-3h9f-9p8f
-
Chainguard
CGA-j29w-ppm7-4hg8
-
Chainguard
CGA-j4cf-qh37-fvjx
-
Chainguard
CGA-j57c-hq9f-363w
-
Chainguard
CGA-j695-52g7-w9m8
-
Chainguard
CGA-jcg2-p8hf-r3gm
-
Chainguard
CGA-jj74-g7rw-pgm4
-
Chainguard
CGA-jjfq-gwxm-ccgx
-
Chainguard
CGA-jp2p-jpr8-7q2f
-
Chainguard
CGA-jqq9-8c9j-mpwg
-
Chainguard
CGA-m22m-4qg5-4vmq
-
Chainguard
CGA-m2jc-rf93-g8qj
-
Chainguard
CGA-m7mm-m258-r9cv
-
Chainguard
CGA-m7wx-c4rm-6m5w
-
Chainguard
CGA-m9x9-ghh7-7vcw
-
Chainguard
CGA-mhw8-h5vw-cw3g
-
Chainguard
CGA-mj34-g26c-f22g
-
Chainguard
CGA-mp4p-hx8q-mv5q
-
Chainguard
CGA-mp7f-xqqw-34pm
-
Chainguard
CGA-p29h-ppvh-8ff5
-
Chainguard
CGA-p58f-5jvr-j5rh
-
Chainguard
CGA-p69h-q2f9-vrc8
-
Chainguard
CGA-p77j-993x-p5pq
-
Chainguard
CGA-p82h-qpqq-x8f4
-
Chainguard
CGA-p8pr-5h4f-pjgq
-
Chainguard
CGA-pf54-6gfp-hr83
-
Chainguard
CGA-pfrf-w4pc-hpw8
-
Chainguard
CGA-pr55-hjpj-fmm4
-
Chainguard
CGA-prjg-862h-92r3
-
Chainguard
CGA-pvpr-5wr4-qq4w
-
Chainguard
CGA-pw95-w5wc-qc22
-
Chainguard
CGA-pwmw-6q47-qc67
-
Chainguard
CGA-px8p-22f7-g7v4
-
Chainguard
CGA-q3g6-g9c7-9c57
-
Chainguard
CGA-q4mw-gpc9-v5x6
-
Chainguard
CGA-q5cx-q6pq-q5wf
-
Chainguard
CGA-q67v-v5hj-p4vc
-
Chainguard
CGA-q6x5-29q8-x5q3
-
Chainguard
CGA-q77r-j95x-qr3p
-
Chainguard
CGA-q794-cjpq-28pv
-
Chainguard
CGA-q7pj-fc37-g2cv
-
Chainguard
CGA-qfjq-h3c9-hxgc
-
Chainguard
CGA-qg9g-pp68-833q
-
Chainguard
CGA-qrfm-4jj4-gmg3
-
Chainguard
CGA-qvfm-4jcj-34q3
-
Chainguard
CGA-qvq5-g6h8-pqhf
-
Chainguard
CGA-r46c-fg92-xcgh
-
Chainguard
CGA-r4q7-g3fr-c638
-
Chainguard
CGA-r569-9c33-vw2x
-
Chainguard
CGA-r6cj-5h5m-fq6m
-
Chainguard
CGA-r98v-82fp-rwg2
-
Chainguard
CGA-r9q5-cv79-qwxr
-
Chainguard
CGA-rcr6-q27c-ffgf
-
Chainguard
CGA-rfhq-656p-88gm
-
Chainguard
CGA-rfm3-gmrp-7rgp
-
Chainguard
CGA-rg54-q49x-qvfv
-
Chainguard
CGA-rg5q-2mx7-2wgx
-
Chainguard
CGA-rh74-9v7q-v8p6
-
Chainguard
CGA-rm8c-8fph-x3mh
-
Chainguard
CGA-rpj2-gvxj-q78f
-
Chainguard
CGA-rw2v-3mvh-2872
-
Chainguard
CGA-rw6r-wx7m-pqqw
-
Chainguard
CGA-rwjm-xrf2-3qmf
-
Chainguard
CGA-rwmf-3wpv-9p37
-
Chainguard
CGA-v2mv-j36g-9hr7
-
Chainguard
CGA-v44j-vj6c-j7jw
-
Chainguard
CGA-v482-hp42-rw8q
-
Chainguard
CGA-v4fp-2rwr-vgv9
-
Chainguard
CGA-v647-4cwr-g639
-
Chainguard
CGA-v665-qjrx-cpmh
-
Chainguard
CGA-v8g2-44h4-3cqw
-
Chainguard
CGA-vg77-29x5-4jff
-
Chainguard
CGA-vghx-r5m9-8v44
-
Chainguard
CGA-vhj7-48wx-f8v9
-
Chainguard
CGA-vpr2-cc52-vh84
-
Chainguard
CGA-vr85-q9q4-6v5c
-
Chainguard
CGA-vrmp-3968-m485
-
Chainguard
CGA-vvh2-58xh-vx7x
-
Chainguard
CGA-vvv4-p2gj-r368
-
Chainguard
CGA-w7fw-5gjf-pmv8
-
Chainguard
CGA-w7wh-ph67-wqwr
-
Chainguard
CGA-wcff-2663-f5c9
-
Chainguard
CGA-wcxw-2wxj-v6pg
-
Chainguard
CGA-wf9j-r6jq-85wp
-
Chainguard
CGA-wgvc-w4f3-rgw8
-
Chainguard
CGA-wmc3-m7r6-3vx3
-
Chainguard
CGA-wp52-whgx-rpqc
-
Chainguard
CGA-wp85-8fgx-j962
-
Chainguard
CGA-wprr-hmrm-cp2w
-
Chainguard
CGA-ww6j-272j-cj8x
-
Chainguard
CGA-ww78-qprc-qr9h
-
Chainguard
CGA-ww85-w9w2-5m33
-
Chainguard
CGA-wxr3-9r4q-wwxf
-
Chainguard
CGA-x3gh-pgmj-4v86
-
Chainguard
CGA-xcxw-9493-3gq3
-
Chainguard
CGA-xf38-3gvv-gjgj
-
Chainguard
CGA-xfx5-p5hx-fc62
-
Chainguard
CGA-xg8r-9j9g-42g2
-
Chainguard
CGA-xg99-xh68-xcv4
-
Chainguard
CGA-xjrc-9f97-8jm8
-
Chainguard
CGA-xpgr-wj46-h3fx
-
Chainguard
CGA-xrq2-69c6-4xpw
-
Chainguard
CGA-xv3c-56qr-3vcv
-
Chainguard
CGA-xvhg-85mp-v2xf
-
Chainguard
CGA-xww6-fvc8-4qwv
-
Chainguard
CGA-xxf9-grm8-f2hp
-
Chainguard
CGA-xxrg-cmp9-9vhm
-
minimos
MINI-386p-7h86-69j3
-
minimos
MINI-56qp-4hrm-g2cg
-
minimos
MINI-5c26-v7h4-6649
-
minimos
MINI-5r4p-j7cm-756g
-
minimos
MINI-96j5-m6vp-q457
-
minimos
MINI-98f4-8fh4-xx5q
-
minimos
MINI-c2r8-8347-5c8j
-
minimos
MINI-cch2-7gp7-pqj7
-
minimos
MINI-cw65-mxmp-c5hp
-
minimos
MINI-fjph-7vr4-rgx6
-
minimos
MINI-hjp8-w4pp-3qhr
-
minimos
MINI-mjmf-3gx2-35w5
-
minimos
MINI-p77v-j94p-hxx6
-
minimos
MINI-p95r-24gv-vr57
-
minimos
MINI-pcwh-p4cq-cgvr
-
minimos
MINI-rvhc-r8p7-h9fv
-
minimos
MINI-vrh9-j9c8-x7hm
-
minimos
MINI-w9h4-hvm6-xww9
-
minimos
MINI-wjpm-j337-hxpq
-
minimos
MINI-xc7f-vrxx-344q
-
minimos
MINI-xvj6-qf8r-mvm5
-