Memory Consumption Issue in Go JOSE Affects JSON Security Standards

CVE-2025-27144

Summary

Go JOSE, an implementation of the Javascript Object Signing and Encryption standards, is impacted by a vulnerability wherein parsing certain compact JWS or JWE tokens can lead to excessive memory consumption. This vulnerability arises from the method used to split JWT tokens, particularly when processing maliciously crafted tokens that contain an unusually high number of period (.) characters. Attackers can leverage this flaw to exhaust memory resources, potentially leading to Denial of Service conditions. Version 4.0.5 of Go JOSE resolves this issue, and a recommended workaround involves validating token payloads to ensure they do not contain excessive periods.

References