PT-2025-7796 · Go Jose+5 · Go-Jose+5
Mcpherrin
·
Published
2025-02-24
·
Updated
2026-02-20
·
CVE-2025-27144
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Go JOSE versions 4.0.0 through 4.0.4
Description
The issue is related to excessive memory consumption when parsing compact JWS or JWE input. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of
. characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.Recommendations
For versions 4.0.0 through 4.0.4, update to version 4.0.5 to fix the issue.
As a temporary workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of
. characters.Exploit
Fix
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Go-Jose
Red Hat
Red Os
Rocky Linux
Suse