CVE-2025-22868 is a vulnerability in the golang.org/x/oauth2/jws package's token parsing component, specifically due to the use of strings.Split(token, ".") to split JWT tokens. Malicious tokens with a large number of '.' characters can cause excessive memory consumption, leading to denial of service via memory exhaustion. Red Hat OpenShift distributed tracing versions >=3.5.0 and <3.5.1 are affected. Red Hat released version 3.5.1 with fixes for this and other CVEs. The recommended mitigation is to pre-validate payloads passed to go-jose to ensure they do not contain excessive '.' characters. The vulnerability has a Red Hat CVSS v3 score of 7.5 (high severity) with network attack vector, low complexity, no privileges required, and high availability impact. No known exploits in the wild have been reported. The vendor advisory provides detailed remediation instructions and upgrade guidance.

The vulnerability allows an attacker to cause excessive memory consumption by sending numerous malformed JWT tokens with many '.' characters, leading to denial of service through memory exhaustion. There is no impact on confidentiality or integrity. The attack requires no privileges or user interaction and can be performed remotely over the network. This can disrupt availability of the affected Red Hat OpenShift distributed tracing service.

Red Hat has released OpenTelemetry version 3.5.1 which includes fixes for CVE-2025-22868. Users should upgrade affected versions (>=3.5.0 <3.5.1) to 3.5.1 or later. Additionally, it is recommended to pre-validate any JWT payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters to prevent memory exhaustion. Refer to Red Hat's official advisory and documentation for upgrade procedures and detailed mitigation steps. No breaking changes or deprecations affect the upgrade process.