This advisory covers multiple vulnerabilities affecting Red Hat AI Inference Server 3.2.0 through 3.2.5 (ROCm). Among these, CVE-2025-22868 is a flaw in the golang.org/x/oauth2/jws package's token parsing logic, where the use of strings.Split(token, ".") can cause excessive memory consumption and denial of service when processing tokens with many '.' characters. The advisory lists 11 CVEs in total, including CVE-2025-9230. Red Hat has not yet provided patches for these vulnerabilities. The vendor recommends mitigation by pre-validating tokens to prevent excessive '.' characters. The vulnerabilities have not been observed exploited in the wild. The advisory emphasizes that CVSS scores may vary by vendor and that Red Hat's severity rating is high for these issues.

The primary impact is potential denial of service due to memory exhaustion when processing maliciously crafted tokens, as seen in CVE-2025-22868. Other vulnerabilities included in the advisory may have varying impacts, but no exploits are currently known in the wild. The high severity rating indicates significant risk if exploited, particularly affecting availability of the AI Inference Server.

No official fix or patch is currently available for these vulnerabilities. Red Hat recommends pre-validating any payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters, mitigating the risk of memory exhaustion and denial of service. Users should monitor Red Hat advisories for updates and patches. Applying this mitigation reduces risk until an official fix is released.