The vulnerability CVE-2025-22868 exists in the golang.org/x/oauth2/jws package's token parsing component, where the use of strings.Split(token, ".") to split JWT tokens can be exploited by sending tokens with an excessive number of '.' characters. This causes excessive memory consumption and can result in denial of service due to memory exhaustion. The issue affects Red Hat Trusted Artifact Signer (RHTAS) versions used with OpenShift Container Platform 4.14 to 4.18. Red Hat has documented this issue and recommends pre-validating payloads to limit '.' characters before processing. There is no official patch or fix released as of the latest advisory RHSA-2025:3811.

An attacker can cause denial of service by sending numerous malformed JWT tokens with a large number of '.' characters to the vulnerable component, triggering excessive memory consumption and potential service disruption. There is no indication of confidentiality or integrity impact. The vulnerability affects the availability of the Red Hat Trusted Artifact Signer service.

Red Hat recommends pre-validating any payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters to mitigate this vulnerability. No official patch or fix is currently available. Users should monitor Red Hat advisories for updates and consider applying this input validation as a temporary mitigation.