This advisory covers multiple vulnerabilities affecting Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA), including CVE-2025-9230 and six additional CVEs. Among these, CVE-2025-22868 is a flaw in the golang.org/x/oauth2/jws package where token parsing uses strings.Split(token, "."), allowing an attacker to craft tokens with excessive '.' characters that cause high memory consumption and denial of service. The vulnerabilities are associated with several CWEs such as CWE-787 (out-of-bounds write), CWE-606 (unverified input in loop condition), CWE-1286 (improper validation of syntactic correctness), CWE-770 (allocation of resources without limits), CWE-59 (link following), and CWE-405 (missing initialization). Red Hat has not yet released patches or fixes for these issues. The vendor advisory recommends mitigation by pre-validating tokens to avoid excessive '.' characters. No active exploitation is known, and the vulnerabilities affect the exact version 3.2.5 of the product. The product is not cloud-hosted, so remediation depends on patch availability.

The primary impact is potential denial of service due to memory exhaustion when processing maliciously crafted tokens with excessive '.' characters. This can disrupt availability of the Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA). No confidentiality or integrity impacts are explicitly stated. The vulnerabilities collectively represent a high severity risk to affected systems. No known exploits in the wild have been reported.

No official patches or fixes are currently available for these vulnerabilities. Red Hat recommends pre-validating any payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters to mitigate the token parsing memory exhaustion issue (CVE-2025-22868). Users should monitor Red Hat advisories for updates and apply patches once released. Since this is not a cloud service, remediation requires user action to update or mitigate.