CVE-2025-27144 Go JOSE's Parsing Vulnerable to Denial of Service
An attacker can cause memory exhaustion and denial of service by sending maliciously crafted JWT tokens with excessive delimiters to applications using the Go JOSE library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27144?
CVE-2025-27144 is a medium-severity denial of service vulnerability in go-jose, published on 24 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.
Weakness: CWE-770
Which versions are affected by CVE-2025-27144?
10 open source packages ship an affected version, including github.com/go-jose/go-jose, github.com/go-jose/go-jose/v3 and github.com/go-jose/go-jose/v4.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-jose/go-jose Go | All versions | None |
github.com/go-jose/go-jose Go | All versions | 3.0.4 |
github.com/go-jose/go-jose Go | All versions | 3.0.4 |
github.com/go-jose/go-jose/v3 Go | All versions | 3.0.4 |
github.com/go-jose/go-jose/v3 Go | All versions | 3.0.4 |
github.com/go-jose/go-jose/v3 Go | All versions | 3.0.4 |
4 more packages
github.com/go-jose/go-jose/v4 Go | All versions | 4.0.5 |
github.com/go-jose/go-jose/v4 Go | All versions | 4.0.5 |
github.com/go-jose/go-jose/v4 Go | All versions | 4.0.5 |
github.com/square/go-jose Go | All versions | None |
Linux distribution packages (30)
buildah AlmaLinux:10 | All versions | 2:1.39.4-1.el10_0 |
buildah-tests AlmaLinux:10 | All versions | 2:1.39.4-1.el10_0 |
osbuild-composer AlmaLinux:10 | All versions | 134.1-3.el10_0.alma.1 |
osbuild-composer-core AlmaLinux:10 | All versions | 134.1-3.el10_0.alma.1 |
osbuild-composer-worker AlmaLinux:10 | All versions | 134.1-3.el10_0.alma.1 |
skopeo AlmaLinux:10 | All versions | 2:1.18.1-1.el10_0 |
skopeo-tests AlmaLinux:10 | All versions | 2:1.18.1-1.el10_0 |
buildah AlmaLinux:9 | All versions | 2:1.39.4-1.el9_6 |
buildah-tests AlmaLinux:9 | All versions | 2:1.39.4-1.el9_6 |
skopeo AlmaLinux:9 | All versions | 2:1.18.1-1.el9_6 |
skopeo-tests AlmaLinux:9 | All versions | 2:1.18.1-1.el9_6 |
buildah Red Hat:enterprise_linux:10.0 | All versions | 2:1.39.4-1.el10_0 |
buildah-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 2:1.39.4-1.el10_0 |
buildah-debugsource Red Hat:enterprise_linux:10.0 | All versions | 2:1.39.4-1.el10_0 |
buildah-tests Red Hat:enterprise_linux:10.0 | All versions | 2:1.39.4-1.el10_0 |
buildah-tests-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 2:1.39.4-1.el10_0 |
osbuild-composer Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-3.el10_0 |
osbuild-composer-core Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-3.el10_0 |
osbuild-composer-core-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-3.el10_0 |
osbuild-composer-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-3.el10_0 |
osbuild-composer-tests-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-3.el10_0 |
osbuild-composer-worker Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-3.el10_0 |
osbuild-composer-worker-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-3.el10_0 |
skopeo Red Hat:enterprise_linux:10.0 | All versions | 2:1.18.1-1.el10_0 |
skopeo-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 2:1.18.1-1.el10_0 |
skopeo-debugsource Red Hat:enterprise_linux:10.0 | All versions | 2:1.18.1-1.el10_0 |
skopeo-tests Red Hat:enterprise_linux:10.0 | All versions | 2:1.18.1-1.el10_0 |
buildah Red Hat:enterprise_linux:9::appstream | All versions | 2:1.39.4-1.el9_6 |
buildah-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.39.4-1.el9_6 |
buildah-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 2:1.39.4-1.el9_6 |
How do I fix CVE-2025-27144?
Upgrade github.com/go-jose/go-jose to 3.0.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-27144 being exploited?
There is no known exploitation of CVE-2025-27144 in the wild and no public exploit code.
Sources
Also known as ALSA-2025:19566, ALSA-2025:7389, ALSA-2025:7397, ALSA-2025:7459, ALSA-2025:7467, AZL-57096 and 112 more.