CVE-2025-22868 is a vulnerability in the golang.org/x/oauth2/jws package's token parsing logic. The package uses strings.Split(token, ".") to split JWT tokens, which can be exploited by sending tokens with a large number of '.' characters, causing excessive memory consumption and potential denial of service. This affects Red Hat OpenShift Logging 6.2.7 and related components. Red Hat recommends pre-validating payloads passed to go-jose to check for excessive '.' characters to mitigate the issue. The vulnerability has a CVSS v3 base score of 7.5 (high) as assessed by Red Hat, with no confidentiality or integrity impact but high availability impact.

An attacker can cause denial of service by sending numerous malformed JWT tokens containing excessive '.' characters, leading to memory exhaustion in affected components. This impacts availability of services relying on the vulnerable token parsing logic. There is no impact on confidentiality or integrity.

Red Hat advises pre-validating any payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters. Users should upgrade to Red Hat OpenShift Logging 6.2.7 or later where the issue is addressed. Follow Red Hat's official upgrade and patch instructions as detailed in their advisory. No other immediate actions are required beyond applying the update and validation.