CVE-2025-7195 affects Red Hat Advanced Cluster Management for Kubernetes versions >=2.13.0 <2.13.5. The vulnerability arises from the use of the Go JOSE library, which improperly handles JWT token parsing by splitting tokens on '.' characters without limiting the number of splits. This can be exploited by sending tokens with excessive '.' characters, causing excessive memory allocation and leading to denial of service via resource exhaustion. The Red Hat advisory provides updated container images in version 2.13.5 that fix this and other related issues. The advisory references multiple related CVEs and bug fixes addressing race conditions, probe failures, and other stability problems.

Successful exploitation of this vulnerability can cause denial of service due to excessive memory consumption in the Go JOSE library when parsing malicious JWT tokens. This can disrupt the availability of the Red Hat Advanced Cluster Management for Kubernetes service. No confidentiality or integrity impacts are reported. The vulnerability requires no privileges or user interaction and can be triggered remotely via network.

A security update is available in Red Hat Advanced Cluster Management for Kubernetes version 2.13.5 that addresses this vulnerability. Users should apply this update after ensuring all previously released relevant errata are applied. As a workaround prior to updating, applications can pre-validate JWT payloads to reject tokens containing an excessive number of '.' characters to prevent memory exhaustion. Refer to Red Hat's official advisory and documentation for detailed update instructions.