| id: GO-2025-3488 |
| modules: |
| - module: golang.org/x/oauth2 |
| versions: |
| - fixed: 0.27.0 |
| vulnerable_at: 0.26.0 |
| packages: |
| - package: golang.org/x/oauth2/jws |
| symbols: |
| - Verify |
| summary: Unexpected memory consumption during token parsing in golang.org/x/oauth2 |
| description: |- |
| An attacker can pass a malicious malformed token which causes unexpected memory |
| to be consumed during parsing. |
| credits: |
| - jub0bs |
| references: |
| - fix: https://go.dev/cl/652155 |
| - report: https://go.dev/issue/71490 |
| cve_metadata: |
| id: CVE-2025-22868 |
| cwe: 'CWE-1286: Improper Validation of Syntactic Correctness of Input' |
| source: |
| id: go-security-team |
| created: 2025-02-25T16:34:28.98413-05:00 |
| review_status: REVIEWED |
