CVE-2025-27144: Go JOSE's Parsing Vulnerable to Denial of Service
Impact When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.
Patches Version 4.0.5 fixes this issue
Workarounds Applications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters.
References This is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.
Other sources
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of . characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of . characters.
— NVD
Go JOSE's Parsing Vulnerable to Denial of Service
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/go-jose/go-joseto a version that resolves this vulnerability.Fixed in 3.0.4 - Upgrade
Upgrade
go/github.com/go-jose/go-jose/v3to a version that resolves this vulnerability.Fixed in 3.0.4 - Upgrade
Upgrade
go/github.com/go-jose/go-jose/v4to a version that resolves this vulnerability.Fixed in 4.0.5 - Upgrade
Upgrade
go-joseto a version that resolves this vulnerability.Fixed in 4.0.5 - Configuration
Pre-validate payloads/tokens passed to Go JOSE so they do not contain an excessive number of '.' characters, to avoid triggering the memory-exhaustion DoS during parsing of compact JWS/JWE.
Applications using go-jose (JWT/JWS/JWE parsing) payload token delimiter count ('.' characters) = pre-validate to reject tokens containing an excessive number of '.' characters before passing to go-jose
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27144?
CVE-2025-27144 is classified as a high severity vulnerability due to its potential to cause excessive memory consumption.
How do I fix CVE-2025-27144?
To fix CVE-2025-27144, upgrade to go-jose version 4.0.5 or later.
What software is affected by CVE-2025-27144?
CVE-2025-27144 affects the go-jose library, specifically versions prior to 4.0.5.
What are the consequences of CVE-2025-27144?
The consequences of CVE-2025-27144 include potential denial of service due to excessive memory usage when processing certain JWT tokens.
What specific input causes issues with CVE-2025-27144?
CVE-2025-27144 is triggered by maliciously crafted JWT types containing an excessive number of '.' characters.