Read the docs
TI-2025-20001 Aliases CVE-2025-27144GHSA-c6gw-w398-hv78

Go JOSE's Parsing Vulnerable to Denial of Service

Priority LOW 35CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 28 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00399 34th percentileScored 2026-11-07
Fix Partial go-jose (go-jose): 4.0.5github.com/go-jose/go-jose/v4 (Go): 4.0.5+2 more productsRed Hat: 41 advisoriesRed Hat: 28 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-josego-jose4.0.0 to before 4.0.54.0.5Patch availableCNA
—github.com/go-jose/go-jose/v4 (Go)before 4.0.54.0.5Patch availableGHSA-c6gw-w398-hv78
—github.com/go-jose/go-jose/v3 (Go)before 3.0.43.0.4Patch availableGHSA-c6gw-w398-hv78
—github.com/go-jose/go-jose (Go)before 3.0.43.0.4Patch availableGHSA-c6gw-w398-hv78
  • go-jose Vendorgo-jose Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available CNA
  • github.com/go-jose/go-jose/v4 (Go) Vendor— Affected before 4.0.5 Fixed in 4.0.5 Patch available GHSA-c6gw-w398-hv78
  • github.com/go-jose/go-jose/v3 (Go) Vendor— Affected before 3.0.4 Fixed in 3.0.4 Patch available GHSA-c6gw-w398-hv78
  • github.com/go-jose/go-jose (Go) Vendor— Affected before 3.0.4 Fixed in 3.0.4 Patch available GHSA-c6gw-w398-hv78

Remediation

  • Fix · CNA go-jose (go-jose) Fixed in 4.0.5
  • Fix · GHSA-c6gw-w398-hv78 github.com/go-jose/go-jose/v4 (Go) Fixed in 4.0.5 Advisory →
  • Fix · GHSA-c6gw-w398-hv78 github.com/go-jose/go-jose/v3 (Go) Fixed in 3.0.4 Advisory →
  • Fix · GHSA-c6gw-w398-hv78 github.com/go-jose/go-jose (Go) Fixed in 3.0.4 Advisory →

Red Hat 41 advisories

  • RHSA-2026:3718 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.4
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel8
  • RHSA-2026:0627 Released 2026-01-14 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9 +19
  • RHSA-2025:22684 Released 2025-12-03 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +5
Show 38 more Red Hat advisories
  • RHSA-2025:22014 Released 2025-11-25 · Red Hat rating Moderate
    cert-manager Operator for Red Hat OpenShift 1.15.2
    • cert-manager operator for Red Hat OpenShift 1.15 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2025:19594 Released 2025-11-04 · Red Hat rating Moderate
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-132.2-3.el9_6, osbuild-composer-core-132.2-3.el9_6, osbuild-composer-worker-132.2-3.el9_6
  • RHSA-2025:19566 Released 2025-11-04 · Red Hat rating Moderate
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 10) osbuild-composer-134.1-3.el10_0, osbuild-composer-core-134.1-3.el10_0, osbuild-composer-worker-134.1-3.el10_0
  • RHSA-2025:11396 Released 2025-07-18 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.4.5 security and bug fix update
    • 9Base-OADP-1.4 oadp/oadp-kubevirt-velero-plugin-rhel9, oadp/oadp-mustgather-rhel9, oadp/oadp-rhel9-operator +5
  • RHSA-2024:11038 Released 2025-06-17 · Red Hat rating Important
    OpenShift Container Platform 4.19.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 openshift4/ose-aws-ebs-csi-driver-rhel9, openshift4/ose-azure-disk-csi-driver-rhel9, openshift4/ose-azure-file-csi-driver-rhel9 +14
  • RHSA-2025:9167 Released 2025-06-17 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.6.0 release
    • Red Hat OpenShift distributed tracing 3.6.0 registry.redhat.io/rhosdt/opentelemetry-rhel8-operator
  • RHSA-2025:7669 Released 2025-05-21 · Red Hat rating Moderate
    OpenShift Container Platform 4.17.30 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/ose-operator-framework-tools-rhel9, openshift4/ose-operator-lifecycle-manager-rhel9, openshift4/ose-operator-registry-rhel9
  • RHSA-2025:8059 Released 2025-05-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.7 Bug Fix Update
    • RHODF 4.17 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +8
  • RHSA-2025:7753 Released 2025-05-15 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.15.2 security update
    • Red Hat OpenShift GitOps 1.15 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-extensions-rhel8, openshift-gitops-1/argocd-rhel8 +7
  • RHSA-2025:4723 Released 2025-05-15 · Red Hat rating Moderate
    OpenShift Container Platform 4.17.29 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/container-networking-plugins-microshift-rhel9, openshift4/driver-toolkit-rhel9, openshift4/network-tools-rhel9 +23
  • RHSA-2025:4712 Released 2025-05-14 · Red Hat rating Moderate
    OpenShift Container Platform 4.18.13 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-operator-framework-tools-rhel9, openshift4/ose-operator-lifecycle-manager-rhel9, openshift4/ose-operator-registry-rhel9
  • RHSA-2025:7459 Released 2025-05-13 · Red Hat rating Moderate
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 10) buildah-2:1.39.4-1.el10_0, buildah-tests-2:1.39.4-1.el10_0
  • RHSA-2025:7467 Released 2025-05-13 · Red Hat rating Moderate
    skopeo security update
    • Red Hat Enterprise Linux AppStream (v. 10) skopeo-2:1.18.1-1.el10_0, skopeo-tests-2:1.18.1-1.el10_0
  • RHSA-2025:7479 Released 2025-05-13 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.107.0-9.el10_0
  • RHSA-2025:7462 Released 2025-05-13 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 10) podman-6:5.4.0-9.el10_0, podman-docker-6:5.4.0-9.el10_0, podman-remote-6:5.4.0-9.el10_0
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests-6:5.4.0-9.el10_0
  • RHSA-2025:7407 Released 2025-05-13 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.107.0-8.el9_6
  • RHSA-2025:7397 Released 2025-05-13 · Red Hat rating Moderate
    skopeo security update
    • Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.18.1-1.el9_6, skopeo-tests-2:1.18.1-1.el9_6
  • RHSA-2025:7391 Released 2025-05-13 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-5:5.4.0-9.el9_6, podman-docker-5:5.4.0-9.el9_6, podman-plugins-5:5.4.0-9.el9_6 +2
  • RHSA-2025:7389 Released 2025-05-13 · Red Hat rating Moderate
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.39.4-1.el9_6, buildah-tests-2:1.39.4-1.el9_6
  • RHSA-2025:4427 Released 2025-05-09 · Red Hat rating Important
    OpenShift Container Platform 4.18.12 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-console-rhel9, openshift4/ose-olm-catalogd-rhel9 +1
  • RHSA-2025:4511 Released 2025-05-06 · Red Hat rating Important
    RHODF-4.18-RHEL-9 security update
    • RHODF 4.18 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +7
  • RHSA-2025:4211 Released 2025-05-01 · Red Hat rating Important
    OpenShift Container Platform 4.18.11 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-cluster-etcd-rhel9-operator, openshift4/ose-olm-operator-controller-rhel9, rhcos
  • RHSA-2025:3906 Released 2025-04-16 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.9.13
    • RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
  • RHSA-2025:3775 Released 2025-04-16 · Red Hat rating Important
    OpenShift Container Platform 4.18.9 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/azure-kms-encryption-provider-rhel9, openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel9 +4
  • RHSA-2025:3820 Released 2025-04-10 · Red Hat rating Important
    RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/gitsign-rhel9
  • RHSA-2025:3743 Released 2025-04-09 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.5.1 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel8, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8
  • RHSA-2025:3593 Released 2025-04-03 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) opentelemetry-collector-0.107.0-7.el9_4
  • RHSA-2025:3301 Released 2025-04-03 · Red Hat rating Important
    OpenShift Container Platform 4.16.38 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-agent-installer-api-server-rhel9, openshift4/ose-aws-pod-identity-webhook-rhel9, openshift4/ose-azure-workload-identity-webhook-rhel9 +3
  • RHSA-2025:3501 Released 2025-04-01 · Red Hat rating Important
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.15.1-4 Update
    • Custom Metric Autoscaler operator for Red Hat Openshift 2.15 registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9
  • RHSA-2025:3439 Released 2025-04-01 · Red Hat rating Important
    ACS 4.6 enhancement and security update
    • RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2025:3438 Released 2025-04-01 · Red Hat rating Important
    ACS 4.7 enhancement and security update
    • RHACS 4.7 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-main-rhel8 +9
  • RHSA-2025:3335 Released 2025-03-27 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.107.0-8.el9_5
  • RHSA-2025:3061 Released 2025-03-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.17.22 packages and security update
    • Red Hat OpenShift Container Platform 4.17 podman-5:5.2.2-4.rhaos4.17.el8, podman-5:5.2.2-4.rhaos4.17.el9, podman-catatonit-5:5.2.2-4.rhaos4.17.el8 +13
  • RHSA-2025:3059 Released 2025-03-26 · Red Hat rating Important
    OpenShift Container Platform 4.17.22 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/ose-aws-pod-identity-webhook-rhel9, openshift4/ose-azure-workload-identity-webhook-rhel9, openshift4/ose-cloud-credential-rhel9-operator +1
  • RHSA-2025:3131 Released 2025-03-26 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.1.4
    • RHOL 6.1 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +7
  • RHSA-2025:3132 Released 2025-03-26 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.6
    • RHOL 6.0 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +7
  • RHSA-2025:3068 Released 2025-03-25 · Red Hat rating Moderate
    OpenShift Container Platform 4.18.6 packages and security update
    • Red Hat OpenShift Container Platform 4.18 podman-5:5.2.2-6.rhaos4.18.el9, podman-docker-5:5.2.2-6.rhaos4.18.el9, podman-plugins-5:5.2.2-6.rhaos4.18.el9 +4
  • RHSA-2025:3066 Released 2025-03-25 · Red Hat rating Important
    OpenShift Container Platform 4.18.6 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-aws-pod-identity-webhook-rhel9, openshift4/ose-azure-workload-identity-webhook-rhel9, openshift4/ose-cloud-credential-rhel9-operator +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix planned: Will not fix
OpenShift Service Mesh 3AffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
9Base-OADP-1.4Fixed RHSA-2025:11396
CNV 4.17 for RHEL 9Fixed—
CNV 4.18 for RHEL 9Fixed—
Custom Metric Autoscaler operator for Red Hat Openshift 2.15Fixed RHSA-2025:3501
Quay v3Fixed—
RHACS 4.6 for RHEL 8Fixed RHSA-2025:3439
RHACS 4.7 for RHEL 8Fixed RHSA-2025:3438
RHODF 4.17 for RHEL 9Fixed RHSA-2025:8059
RHODF 4.18 for RHEL 9Fixed RHSA-2025:4511
RHOL 5.9 for RHEL 9Fixed RHSA-2025:3906
RHOL 6.0 for RHEL 9Fixed RHSA-2025:3132
RHOL 6.1 for RHEL 9Fixed RHSA-2025:3131
Red Hat Advanced Cluster Management for Kubernetes 2.12Fixed RHSA-2025:22684
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:0627
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:19566, RHSA-2025:7459, RHSA-2025:7462, RHSA-2025:7467, RHSA-2025:7479
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:19594, RHSA-2025:3335, RHSA-2025:7389, RHSA-2025:7391, RHSA-2025:7397, RHSA-2025:7407
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:3593
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:7462
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:3301
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:3059, RHSA-2025:3061, RHSA-2025:4723, RHSA-2025:7669
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:3066, RHSA-2025:3068, RHSA-2025:3775, RHSA-2025:4211, RHSA-2025:4427, RHSA-2025:4712
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2024:11038
Red Hat OpenShift GitOps 1.15Fixed RHSA-2025:7753
Red Hat OpenShift Pipelines 1.15Fixed RHSA-2026:3718
Red Hat OpenShift distributed tracing 3.5.3Fixed RHSA-2025:3743
Red Hat OpenShift distributed tracing 3.6.0Fixed RHSA-2025:9167
Red Hat Trusted Artifact Signer 1.1Fixed RHSA-2025:3820
cert-manager operator for Red Hat OpenShift 1.15Fixed RHSA-2025:22014
Not affected: 17 products
  • 9Base-OADP-1.4
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • RHODF 4.17 for RHEL 9
  • RHODF 4.18 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.12
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Pipelines 1.15
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenShift distributed tracing 3.5.3
  • Red Hat OpenShift distributed tracing 3.6.0
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27144
  2. 2026-10-03 Alias added: GHSA-c6gw-w398-hv78
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-30 Fix available: CNV 4.18 for RHEL 9 · Red Hat

References

Advisory 1

Other 6

  • TI-2026-80925 Denial of service in go-jose when parsing JWKs with RSA keys CVSS 3.1HIGH 7.5
  • TI-2026-80924 Go JOSE: Panics in JSON parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-80923 Panic in Go JOSE CBC-HMAC decryption enables denial of service CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences