The Red Hat AI Inference Server 3.2.5 (CUDA) contains multiple vulnerabilities, including CVE-2025-22868, which involves improper token parsing in the golang.org/x/oauth2/jws package. This vulnerability arises from using strings.Split(token, ".") to parse JWT tokens, allowing attackers to craft tokens with many '.' characters that cause excessive memory consumption and potential denial of service. The advisory lists 11 CVEs affecting the product but does not indicate any available patches or fixes. The vulnerabilities are rated high severity by Red Hat, with no known exploits in the wild. Mitigation recommendations include pre-validating tokens to limit '.' characters before processing.

The primary impact is a denial of service condition caused by memory exhaustion when processing maliciously crafted tokens with excessive '.' characters. This can disrupt the availability of the Red Hat AI Inference Server. No confidentiality or integrity impacts are indicated. There are no known active exploits in the wild at this time.

Currently, no official fix or patch is available for these vulnerabilities in Red Hat AI Inference Server 3.2.5 (CUDA). Red Hat recommends mitigating the token parsing vulnerability by pre-validating any payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters. Users should monitor Red Hat advisories for updates and consider applying mitigations as described until a fix is released.