VYPR
← All advisories
High severityNVD Advisory· Published Feb 26, 2025· Updated Feb 26, 2025

Unexpected memory consumption during token parsing in golang.org/x/oauth2

CVE-2025-22868

Description

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Malformed tokens in Go's standard library can cause excessive memory consumption during parsing, leading to a denial of service.

Vulnerability

Overview CVE-2025-22868 is a denial-of-service vulnerability in the Go standard library. An attacker can craft a malicious malformed token that, when parsed, causes unexpected memory consumption [1]. This issue affects token parsing routines, potentially leading to resource exhaustion.

Exploitation

Details The vulnerability can be exploited by sending a specially crafted token to an application that uses Go's token parsing functionality. No authentication is required, and the attacker does not need special network access beyond being able to deliver the malformed input. The parsing process consumes excessive memory due to the malformed token, leading to application slowdown or crash [2].

Impact

Successful exploitation results in a denial of service, where the targeted application may become unresponsive or terminate due to memory exhaustion. This can affect services that rely on Go's token parsing, such as web servers or authentication systems.

Mitigation

The issue has been addressed in the Go project via commit https://go.dev/cl/652155 [2] and is included in subsequent Go releases. Users are advised to update to the latest patched version. The vulnerability is tracked in the Go vulnerability database as GO-2025-3488 [3].

References
  1. NVD - CVE-2025-22868
  2. security: fix CVE-2025-22868
  3. GO-2025-3488 - Go Packages

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/oauth2Go
< 0.27.00.27.0

Affected products

4534

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.