Red Hat AI Inference Server 3.2.0 through 3.2.5 (CUDA) is affected by multiple vulnerabilities including CVE-2025-9230 and CVE-2025-22868 among others. One notable issue is in the golang.org/x/oauth2/jws package where token parsing uses strings.Split on JWT tokens, which can lead to excessive memory consumption and denial of service when processing maliciously crafted tokens with many '.' characters. The vulnerabilities span several CWE categories such as improper input validation (CWE-1286), out-of-bounds write (CWE-787), and others. The Red Hat advisory RHSA-2025:23204 confirms these issues but does not currently provide patches or fixes. The advisory recommends mitigation by pre-validating payloads to limit excessive '.' characters in tokens. There are no known active exploits reported.

The vulnerabilities can lead to denial of service conditions primarily through memory exhaustion caused by malformed tokens. This can disrupt availability of the Red Hat AI Inference Server. No confidentiality or integrity impacts are explicitly stated. No active exploitation has been reported. The overall impact is high due to potential service disruption.

Currently, no official patches or fixes are available for these vulnerabilities as per the Red Hat advisory RHSA-2025:23204. The vendor recommends mitigating the token parsing vulnerability by pre-validating any payloads passed to the affected components to ensure they do not contain an excessive number of '.' characters. Users should monitor Red Hat advisories for updates and consider applying mitigations as recommended. Upgrading to a fixed version when available is advised.