CVE-2025-22868

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Summary

We have encountered a security vulnerability being reported by our scanners for Traefik 2.11.22.

• https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TRAEFIK33-9403297

Details

It seems to target oauth2/jws library.

PoC

No steps to replicate this vulnerability

Impact

We have a strict control on security and we always try to stay up-to-date with the fixes received for third-party solutions.

Patches

• https://github.com/traefik/traefik/releases/tag/v2.11.24
• https://github.com/traefik/traefik/releases/tag/v3.3.6
• https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

• go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

• golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868)

• github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input (CVE-2025-29786)

• golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-22868 in the golang.org/x/oauth2 package for Root:Go. Multiple fixed versions available.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

This update for restic fixes the following issues:

• Fixed CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (boo#1239264)

• Update to version 0.17.3

  • Fix #4971: Fix unusable mount on macOS Sonoma
  • Fix #5003: Fix metadata errors during backup of removable disks on Windows
  • Fix #5101: Do not retry load/list operation if SFTP connection is broken
  • Fix #5107: Fix metadata error on Windows for backups using VSS
  • Enh #5096: Allow prune --dry-run without lock

• Update to version 0.17.2

  • Fix #4004: Support container-level SAS/SAT tokens for Azure backend
  • Fix #5047: Resolve potential error during concurrent cache cleanup
  • Fix #5050: Return error if tag fails to lock repository
  • Fix #5057: Exclude irregular files from backups
  • Fix #5063: Correctly backup extended metadata when using VSS on Windows

• Update to version 0.17.1

  • Fix #2004: Correctly handle volume names in backup command on Windows
  • Fix #4945: Include missing backup error text with --json
  • Fix #4953: Correctly handle long paths on older Windows versions
  • Fix #4957: Fix delayed cancellation of certain commands
  • Fix #4958: Don't ignore metadata-setting errors during restore
  • Fix #4969: Correctly restore timestamp for files with resource forks on macOS
  • Fix #4975: Prevent backup --stdin-from-command from panicking
  • Fix #4980: Skip extended attribute processing on unsupported Windows volumes
  • Fix #5004: Fix spurious 'A Required Privilege Is Not Held by the Client' error
  • Fix #5005: Fix rare failures to retry locking a repository
  • Fix #5018: Improve HTTP/2 support for REST backend
  • Chg #4953: Also back up files with incomplete metadata
  • Enh #4795: Display progress bar for restore --verify
  • Enh #4934: Automatically clear removed snapshots from cache
  • Enh #4944: Print JSON-formatted errors during restore --json
  • Enh #4959: Return exit code 12 for 'bad password' errors
  • Enh #4970: Make timeout for stuck requests customizable

• Update to version 0.17.0

  • Fix #3600: Handle unreadable xattrs in folders above backup source
  • Fix #4209: Fix slow SFTP upload performance
  • Fix #4503: Correct hardlink handling in stats command
  • Fix #4568: Prevent forget --keep-tags <invalid> from deleting all snapshots
  • Fix #4615: Make find not sometimes ignore directories
  • Fix #4656: Properly report ID of newly added keys
  • Fix #4703: Shutdown cleanly when receiving SIGTERM
  • Fix #4709: Correct --no-lock handling of ls and tag commands
  • Fix #4760: Fix possible error on concurrent cache cleanup
  • Fix #4850: Handle UTF-16 password files in key command correctly
  • Fix #4902: Update snapshot summary on rewrite
  • Chg #956: Return exit code 10 and 11 for non-existing and locked repository
  • Chg #4540: Require at least ARMv6 for ARM binaries
  • Chg #4602: Deprecate legacy index format and s3legacy repository layout
  • Chg #4627: Redesign backend error handling to improve reliability
  • Chg #4707: Disable S3 anonymous authentication by default
  • Chg #4744: Include full key ID in JSON output of key list
  • Enh #662: Optionally skip snapshot creation if nothing changed
  • Enh #693: Include snapshot size in snapshots output
  • Enh #805: Add bitrot detection to diff command
  • Enh #828: Improve features of the repair packs command
  • Enh #1786: Support repositories with empty password
  • Enh #2348: Add --delete option to restore command
  • Enh #3067: Add extended options to configure Windows Shadow Copy Service
  • Enh #3406: Improve dump performance for large files
  • Enh #3806: Optimize and make prune command resumable
  • Enh #4006: (alpha) Store deviceID only for hardlinks
  • Enh #4048: Add support for FUSE-T with mount on macOS
  • Enh #4251: Support reading backup from a command's standard output
  • Enh #4287: Support connection to…

This update for cadvisor fixes the following issues:

• update to 0.52.1:

  • Make resctrl optional/pluggable

• update to 0.52.0:

  • bump containerd related deps: api v1.8.0; errdefs v1.0.0; ttrpc v1.2.6
  • chore: Update Prometheus libraries
  • bump runc to v1.2.4
  • Add Pressure Stall Information Metrics
  • Switch to opencontainers/cgroups repository (includes update from golang 1.22 to 1.24)
  • Bump to newer opencontainers/image-spec @ v1.1.1

• update to 0.49.2:

  • Cp fix test
  • Revert 'reduce_logs_for_kubelet_use_crio'

• CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (boo#1239291)

• Update to version 0.49.1:

  • build docker - add --provenance=false flag
  • Remove s390x support
  • Disable libipmctl in build
  • Ugrade base image to 1.22 and alpine 3.18
  • fix type of C.malloc in cgo
  • Bump runc to v1.1.12
  • Bump to bullseye
  • Remove section about canary image
  • Add note about WebUI auth
  • Remove mentions of accelerator from the docs
  • reduce_logs_for_kubelet_use_crio
  • upgrade actions/checkout and actions/setup-go and actions/upload-artifact
  • build(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /cmd
  • add cadvisor and crio upstream changes
  • Avoid using container/podman in manager.go
  • container: skip checking for files in non-existent directories.
  • Adjust the log level of Initialize Plugins
  • add ignored device
  • fix: variable naming
  • build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 in /cmd
  • manager: require higher verbosity level for container info misses
  • Information should be logged on increased verbosity only
  • Running do mod tidy
  • Running go mod tidy
  • Running go mod tidy
  • container/libcontainer: Improve limits file parsing perf
  • container/libcontainer: Add limit parsing benchmark
  • build(deps): bump github.com/cyphar/filepath-securejoin in /cmd
  • build(deps): bump github.com/cyphar/filepath-securejoin
  • Set verbosity after flag definition
  • fix: error message typo
  • vendor: bump runc to 1.1.9
  • Switch to use busybox from registry.k8s.io
  • Bump golang ci lint to v1.54.1
  • Bump github.com/docker/docker in /cmd
  • Bump github.com/docker/docker
  • Bump github.com/docker/distribution in /cmd
  • Bump github.com/docker/distribution
  • Update genproto dependency to isolated submodule
  • remove the check for the existence of NFS files, which will cause unnecessary requests.
  • reduce inotify watch
  • fix performance degradation of NFS
  • fix: fix type issue
  • fix: fix cgo memory leak
  • ft: export memory kernel usage
  • sysinfo: Ignore 'hidden' sysfs device entries
  • Increasing required verbosity level
  • Patch to fix issue 2341
  • podman support: Enable Podman support.
  • podman support: Create Podman handler.
  • podman support: Changes in Docker handler.
  • unit test: machine_swap_bytes
  • Add documentation for machine_swap_bytes metric
  • Add a machine_swap_bytes metric
  • fix: add space trimming for label allowlist
  • Upgrade to blang/semver/v4 v4.0.0
  • docs(deploy/k8s): remote build for kustomize
  • Update dependencies
  • Change filepaths to detect online CPUs
  • Update actions/checkout to v3
  • Fix flags typo
  • Updating location of kubernetes/pause image
  • Using t.TempDir() in tests
  • Unit test: MachineInfo Clone() method
  • Bugfix: MachineInfo Clone() - clone SwapCapacity
  • Optimize network metrics collection
  • Removing calls to deprecates io/ioutil package
  • Updating minimum Go version to 1.19
  • Request the pid of another container if current pid is not longer valid
  • Restructure
  • Add CRI-O client timeout setting
  • Set containerd grpc.MaxCallRecvMsgSize to 16MB
  • Fix asset build
  • feat(logging): add verbosity to non-NUMA node warning
  • add nerdctl to ignoredDevices
  • nvm: Change the 'no NVM devices' log.
  • nvm: Fix typo.
  • Fix CVE-2022-27664 (#3248)
  • resctrl: Reduce size and…

These are all security issues fixed in the teleport-17.2.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250226T025151-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the fake-gcs-server-1.52.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the google-guest-agent-20250116.00-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the google-osconfig-agent-20250115.01-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the restic-0.17.3-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cadvisor-0.52.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the crane-0.20.3-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the docker-stable-24.0.9_ce-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the docker-27.5.1_ce-15.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cosign-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rekor-1.3.10-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the pluto-5.21.7-1.1 package on the GA media of openSUSE Tumbleweed.