The vulnerability CVE-2025-22868 affects the golang.org/x/oauth2/jws package's token parsing component, specifically due to the use of strings.Split(token, ".") to split JWT tokens. Malicious tokens with a large number of '.' characters can cause excessive memory consumption, leading to denial of service via memory exhaustion. This affects Red Hat OpenShift Logging versions >=6.3.0 and <6.3.2. Red Hat has issued an official security advisory and released OpenShift Logging 6.3.2 which includes the fix. The recommended mitigation is to pre-validate payloads passed to go-jose to ensure they do not contain excessive '.' characters.

An attacker can exploit this vulnerability by sending numerous malformed JWT tokens with many '.' characters, causing excessive memory consumption in the token parsing process. This can result in denial of service due to memory exhaustion, impacting availability of the logging subsystem in Red Hat OpenShift clusters.

Red Hat has released OpenShift Logging version 6.3.2 which fixes this vulnerability. Users should upgrade to version 6.3.2 or later to remediate the issue. Additionally, it is recommended to pre-validate any payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters. No other mitigations are specified by the vendor.