The Red Hat AI Inference Server 3.2.0 through 3.2.5 (TPU) contains multiple vulnerabilities, including CVE-2025-22868, which involves improper validation in the golang.org/x/oauth2/jws package. This vulnerability arises from the use of strings.Split(token, ".") to parse JWT tokens, allowing an attacker to craft tokens with many '.' characters that cause excessive memory consumption and potential denial of service. The advisory lists a total of 10 CVEs affecting this product version. No official patches have been released yet, and Red Hat recommends mitigation by pre-validating token payloads to prevent excessive '.' characters. The vulnerabilities have been assigned a high severity rating by Red Hat, but no CVSS score is provided.

The primary impact is denial of service due to memory exhaustion when processing maliciously crafted JWT tokens with many '.' characters. This can disrupt the availability of the Red Hat AI Inference Server. No known exploits are reported in the wild. Other vulnerabilities included in the advisory may have varying impacts but are not detailed here. The overall severity is considered high by Red Hat.

No official patches or fixes have been released yet for these vulnerabilities. Red Hat recommends pre-validating any payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters, mitigating the risk of memory exhaustion. Users should monitor Red Hat advisories for updates and patches. Applying this mitigation reduces the risk of denial of service from malformed tokens.