The vulnerability CVE-2025-22868 affects the golang.org/x/oauth2/jws package's token parsing component, specifically due to the use of strings.Split(token, ".") to split JWT tokens. Malicious tokens with a large number of '.' characters can cause excessive memory consumption, leading to denial of service via memory exhaustion. The issue is fixed in postgres-operator version 1.12.2-r2 and related Red Hat OpenShift Logging 6.2.7 and other affected products. The recommended mitigation is to pre-validate payloads passed to go-jose to ensure they do not contain an excessive number of '.' characters.

An attacker can exploit this vulnerability by sending numerous malformed JWT tokens with excessive '.' characters, causing the vulnerable component to consume excessive memory and potentially crash or become unavailable, resulting in denial of service. There is no impact on confidentiality or integrity, only availability is affected. No known exploits in the wild have been reported.

A patch is available in postgres-operator version 1.12.2-r2 and related Red Hat products such as Red Hat OpenShift Logging 6.2.7. It is recommended to upgrade to these fixed versions. Additionally, pre-validate any JWT tokens or payloads passed to the go-jose library to check for an excessive number of '.' characters to mitigate the vulnerability. Follow vendor upgrade instructions and advisories for full remediation.