CVE-2025-22868 is a denial of service vulnerability in the golang.org/x/oauth2/jws package's token parsing logic, specifically due to the use of strings.Split(token, ".") on JWT tokens. Maliciously crafted tokens with a large number of '.' characters can cause excessive memory consumption, leading to memory exhaustion and service disruption. This vulnerability affects the Red Hat build of OpenTelemetry 3.6.0, including Red Hat OpenShift distributed tracing components. The Red Hat advisory recommends mitigating this by pre-validating payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters. The advisory does not explicitly confirm a patch but provides guidance on mitigation and references related bug reports and CVEs.

An attacker can exploit this vulnerability by sending numerous malformed JWT tokens with many '.' characters, causing excessive memory consumption and potentially triggering a denial of service in affected OpenTelemetry components. The impact is limited to availability disruption; confidentiality and integrity are not affected.

The vendor advisory recommends pre-validating any JWT payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters, thereby preventing memory exhaustion. There is no explicit mention of an official patch or update fixing this issue in the advisory. Users should apply this mitigation and monitor Red Hat's official channels for any forthcoming patches or updates.