CVE-2025-22868 is a vulnerability in the golang.org/x/oauth2/jws package's token parsing component. The vulnerability arises because the code uses strings.Split(token, ".") to split JWT tokens, which can be exploited by sending tokens with a large number of '.' characters. This causes excessive memory consumption, potentially leading to denial of service via memory exhaustion. The issue affects Red Hat OpenShift Data Foundation 4.18 and other related Red Hat products. The vulnerability is tracked under CWE-1286 (Improper Validation of Syntactic Correctness of Input). Red Hat has released a security advisory (RHSA-2025:11830) recommending pre-validation of payloads to mitigate the issue and has provided updates to fix it.

An attacker can cause a denial of service by sending numerous malformed JWT tokens with excessive '.' characters, triggering excessive memory consumption and exhausting system resources. There is no impact on confidentiality or integrity, but availability is highly impacted. No known exploits are reported in the wild at this time.

Red Hat has released an official security advisory with fixes for affected products. It is recommended to apply the update provided by Red Hat OpenShift Data Foundation 4.18 security update RHSA-2025:11830. Additionally, pre-validate any JWT payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters. Ensure all previously released errata relevant to your system are applied before updating.