The Custom Metrics Autoscaler Operator for Red Hat OpenShift, based on Kubernetes Event Driven Autoscaler (KEDA) 2.15.1, contains a vulnerability identified as CVE-2024-34156. This flaw arises from the use of strings.Split(token, ".") in the golang.org/x/oauth2/jws package during JWT token parsing, which can cause excessive memory consumption when processing tokens with many '.' characters. An attacker can exploit this by sending numerous malformed tokens, leading to memory exhaustion and denial of service. Red Hat has issued an update to version 2.15.1-4 of the operator that includes fixes for this and related vulnerabilities (CVE-2025-22868, CVE-2025-27144). The advisory references the Red Hat Security Advisory RHSA-2025:3501 and recommends applying the update after prior errata are installed.

The vulnerability can cause denial of service due to memory exhaustion when the operator processes maliciously crafted tokens containing excessive '.' characters. This impacts availability of the Custom Metrics Autoscaler Operator in Red Hat OpenShift environments. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported at this time.

A fixed update is available in Custom Metrics Autoscaler Operator version 2.15.1-4. Red Hat advises applying this update after ensuring all previously released errata relevant to the system have been applied. Additionally, pre-validation of token payloads to check for excessive '.' characters can mitigate the issue. Users should follow the update instructions provided in the Red Hat advisory RHSA-2025:3501 at https://access.redhat.com/articles/11258. No other mitigation actions are specified or required.