{"schema_version":"1.7.3","id":"GHSA-c6gw-w398-hv78","published":"2025-02-24T22:49:19Z","modified":"2026-02-04T04:11:39.036917Z","aliases":["CVE-2025-27144","GO-2025-3485"],"related":["CGA-p64v-w3j6-xg5w"],"summary":"DoS in go-jose Parsing","details":"### Impact\nWhen parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.\n\n### Patches\nVersion 4.0.5 fixes this issue\n\n### Workarounds\nApplications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters.\n\n### References\nThis is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.","affected":[{"package":{"name":"github.com/go-jose/go-jose/v4","ecosystem":"Go","purl":"pkg:golang/github.com/go-jose/go-jose/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-c6gw-w398-hv78/GHSA-c6gw-w398-hv78.json"}},{"package":{"name":"github.com/go-jose/go-jose/v3","ecosystem":"Go","purl":"pkg:golang/github.com/go-jose/go-jose/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-c6gw-w398-hv78/GHSA-c6gw-w398-hv78.json"}},{"package":{"name":"github.com/go-jose/go-jose","ecosystem":"Go","purl":"pkg:golang/github.com/go-jose/go-jose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-c6gw-w398-hv78/GHSA-c6gw-w398-hv78.json"}}],"references":[{"type":"WEB","url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27144"},{"type":"WEB","url":"https://github.com/golang/go/issues/71490"},{"type":"WEB","url":"https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22"},{"type":"PACKAGE","url":"https://github.com/go-jose/go-jose"},{"type":"WEB","url":"https://github.com/go-jose/go-jose/releases/tag/v4.0.5"},{"type":"WEB","url":"https://go.dev/issue/71490"}],"database_specific":{"cwe_ids":["CWE-400","CWE-770"],"github_reviewed":true,"github_reviewed_at":"2025-02-24T22:49:19Z","nvd_published_at":"2025-02-24T23:15:11Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}