CVE-2025-27144

What it actually does

The library uses strings.Split on untrusted compact JWS/JWE input, allocating memory proportional to the number of dot characters; a token containing thousands of dots exhausts available memory and triggers a denial of service.

Why it matters to the business

Applications that accept JWTs or JWE tokens from untrusted sources can be forced offline, causing service outages and loss of availability for any system relying on this library.

How an attack unfolds

An attacker crafts a compact serialization containing an extremely large number of dot separators, submits it to any endpoint that passes the value to Go JOSE's Parse or Decrypt functions, and repeats the request to drive memory consumption until the process terminates or becomes unresponsive.

How to fix it

Upgrade go-jose/go-jose to commit 99b346cec4e86d102284642c5dcbe9bb0cacfc22 (version 4.0.5 or later). As an immediate mitigation, add an input check that rejects any token containing more than a small fixed number of '.' characters before it reaches the library.

How to confirm the fix worked

Confirm the running binary or module version reports a commit at or after 99b346cec4e86d102284642c5dcbe9bb0cacfc22; re-test with a token containing 10 000 dots and verify that memory usage remains bounded and no crash occurs.

Typical attack path

1. Locate an HTTP or API endpoint that accepts JWT/JWE tokens without prior validation.
2. Generate a compact token string consisting of a valid header and payload separated by thousands of '.' characters.
3. Send the malformed token in an authentication or decryption request.
4. Repeat the request at a rate sufficient to exhaust server memory before garbage collection can reclaim it.

How to detect it

Inspect application logs and request logs for tokens containing unusually high dot counts; correlate with memory-usage spikes or OOM events on the process; look for repeated requests from the same source containing long sequences of '.' characters.

What your security team should do

• Upgrade all instances of go-jose/go-jose to the fixed commit within the next maintenance window.
• Add a lightweight pre-validation filter that limits the number of '.' characters in any incoming token.
• Review other JWT-processing libraries in the environment for similar unbounded-split patterns.
• Monitor memory and request-rate metrics on services that accept JWTs to detect anomalous spikes.