Skip to content
OpenAdvisories
Medium · 6.6 CVE-2025-27144 EUVD-2025-4268GHSA-c6gw-w398-hv78GO-2025-3485

Go JOSE's Parsing Vulnerable to Denial of Service

Published Feb 24, 2025 · Updated Feb 25, 2025 · Assigned by GitHub_M

Vendor: go-jose Product: go-jose Package: aactl Package: apko Package: argo-workflows Package: argocd-image-updater Package: argocd-image-updater-compat Package: bank-vaults Package: bank-vaults-template Package: boring-registry Package: buildah Package: buildah Package: caddy Package: caddy-man Package: caddy-src Package: cert-manager Package: cert-manager-istio-csr Package: cert-manager-istio-csr-compat Package: containerd Package: containerd-1 Package: containerd-2 Package: containerd-service-1 Package: containerd-service-2 Package: containerd-shim-runc-v2-1 Package: containerd-shim-runc-v2-2 Package: containerd-stress-1 Package: containerd-stress-2 Package: containerd2 Package: containerized-data-importer Package: cosign Package: cri-o Package: ctr-1 Package: ctr-2 Package: dagdotdev Package: dagger Package: dcos-cli Package: dex Package: dex-iamguarded-compat Package: dgraph Package: distribution Package: falcoctl Package: flux-kustomize-controller Package: flux-kustomize-controller-iamguarded-compat Package: flux-source-controller Package: flux-source-controller-iamguarded-compat Package: flyte Package: frp Package: fulcio Package: gatus Package: gatus-compat Package: gh Package: github.com/go-jose/go-jose Package: github.com/go-jose/go-jose/v3 Package: github.com/go-jose/go-jose/v4 Package: github.com/square/go-jose Package: gitsign Package: gitsign-config Package: gitsign-credential-cache Package: golang-github-go-jose-go-jose Package: golang-github-go-jose-go-jose Package: gomplate Package: goreleaser Package: grafana-alloy Package: grafana-mimir Package: grpc-health-probe Package: grpc-health-probe-compat Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: harbor-registry Package: hydra Package: ig Package: influxdb Package: istio-pilot-agent-1.25 Package: istio-pilot-agent-1.25-compat Package: k3d Package: k3d-proxy Package: k3d-tools Package: k3s Package: k3s-1.32 Package: k3s-multicall Package: k3s-multicall-1.32 Package: k3s-static Package: k3s-static-1.32 Package: kargo Package: kargo-oci-compat Package: keda Package: kiali Package: ko Package: kots Package: kots-compat Package: kots-symlink-compat Package: ksops Package: ksops-compat Package: kube-rbac-proxy Package: kube-vip-cloud-provider Package: kubernetes Package: kubescape Package: kyverno-notation-aws Package: kyverno-notation-aws-compat Package: kyverno-policy-reporter Package: kyverno-policy-reporter-compat Package: melange Package: minio Package: minio-iamguarded-2025-compat Package: moby-containerd Package: moby-containerd-cc Package: nerdctl Package: neuvector-scanner Package: neuvector-scanner-monitor Package: neuvector-scanner-task Package: oauth2-proxy Package: oauth2-proxy-iamguarded-compat Package: octo-sts Package: octo-sts-webhook Package: openbao Package: openbao-compat Package: opentofu-1.9 Package: packer Package: podman Package: podman Package: podman-doc Package: policy-controller Package: policy-controller-tester Package: pulumi Package: pulumi-language-go Package: pulumi-language-nodejs Package: pulumi-language-python Package: rabbitmq-messaging-topology-operator Package: rabbitmq-messaging-topology-operator-compat Package: rabbitmq-messaging-topology-operator-iamguarded-compat Package: rekor Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: rook Package: rook Package: rook-oci-compat Package: sftpgo Package: sftpgo-plugin-kms Package: sigstore-scaffolding Package: sigstore-scaffolding-cloudsqlproxy Package: sigstore-scaffolding-ctlog-createctconfig Package: sigstore-scaffolding-ctlog-managectroots Package: sigstore-scaffolding-ctlog-verifyfulcio Package: sigstore-scaffolding-fulcio-createcerts Package: sigstore-scaffolding-getoidctoken Package: sigstore-scaffolding-rekor-createsecret Package: sigstore-scaffolding-trillian-createdb Package: sigstore-scaffolding-trillian-createtree Package: sigstore-scaffolding-trillian-updatetree Package: sigstore-scaffolding-tsa-createcertchain Package: sigstore-scaffolding-tuf-createsecret Package: sigstore-scaffolding-tuf-server Package: skaffold Package: skopeo Package: skopeo Package: sops Package: spiffe-helper Package: spiffe-helper-compat Package: spire-agent Package: spire-controller-manager Package: spire-controller-manager-compat Package: spire-oidc-discovery-provider Package: spire-server Package: splunk-otel-collector Package: splunk-otel-collector-compat Package: splunk-otel-collector-doc Package: steampipe Package: step Package: step-ca Package: step-issuer Package: step-issuer-compat Package: step-kms-plugin Package: tekton-chains Package: telegraf Package: temporal Package: temporal-compat Package: temporal-ui-server Package: temporal-ui-server-oci-entrypoint Package: terragrunt Package: terragrunt-docs Package: tflint Package: tflint-compat Package: timestamp-authority Package: timestamp-authority-cli Package: timestamp-authority-server Package: tkn Package: traefik-3.3 Package: trivy Package: trufflehog Package: undock Package: vault-benchmark Package: vault-benchmark-compat Package: vexctl Package: weaviate Package: wolfictl Package: zarf Package: zot Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.

Affected products

VendorProductAffectedFixed
go-jose go-jose >= 4.0.0, < 4.0.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-github-go-jose-go-jose 4.0.5-1 —
Debian 13 golang-github-go-jose-go-jose 4.0.5-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-go-jose-go-jose No fix yet —
Ubuntu 25.10 golang-github-go-jose-go-jose No fix yet —
Ubuntu 24.04 LTS golang-github-go-jose-go-jose No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS golang-github-go-jose-go-jose No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 buildah +1 2:1.39.4-1.el10_0 RHSA-2025:7459
RHEL 10 opentelemetry-collector 0.107.0-9.el10_0 RHSA-2025:7479
RHEL 10 osbuild-composer +2 134.1-3.el10_0 RHSA-2025:19566
RHEL 10 podman +3 6:5.4.0-9.el10_0 RHSA-2025:7462
RHEL 10 skopeo +1 2:1.18.1-1.el10_0 RHSA-2025:7467
RHEL 9 buildah +1 2:1.39.4-1.el9_6 RHSA-2025:7389
RHEL 9 opentelemetry-collector 0.107.0-8.el9_5 RHSA-2025:7407, RHSA-2025:3335
RHEL 9 osbuild-composer +2 132.2-3.el9_6 RHSA-2025:19594
RHEL 9 podman +4 5:5.4.0-9.el9_6 RHSA-2025:7391
RHEL 9 skopeo +1 2:1.18.1-1.el9_6 RHSA-2025:7397
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS opentelemetry-collector 0.107.0-7.el9_4 RHSA-2025:3593
Red Hat OpenShift 4 podman +6 5:5.2.2-4.rhaos4.17.el8 RHSA-2025:3068, RHSA-2025:3061
Red Hat OpenShift 4 skopeo +1 2:1.16.1-1.rhaos4.17.el8 RHSA-2025:3068, RHSA-2025:3061

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 buildah +1 2:1.39.4-1.el10_0 ALSA-2025:7459
AlmaLinux 10 osbuild-composer +2 134.1-3.el10_0.alma.1 ALSA-2025:19566
AlmaLinux 10 podman +3 6:5.4.0-9.el10_0 ALSA-2025:7462
AlmaLinux 10 skopeo +1 2:1.18.1-1.el10_0 ALSA-2025:7467
AlmaLinux 9 buildah +1 2:1.39.4-1.el9_6 ALSA-2025:7389
AlmaLinux 9 skopeo +1 2:1.18.1-1.el9_6 ALSA-2025:7397

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 buildah 2:1.39.4-1.el10_0 RLSA-2025:7459
Rocky Linux 10 opentelemetry-collector 0.107.0-9.el10_0 RLSA-2025:7479
Rocky Linux 10 podman 6:5.4.0-9.el10_0 RLSA-2025:7462
Rocky Linux 10 skopeo 2:1.18.1-1.el10_0 RLSA-2025:7467
Rocky Linux 9 buildah 2:1.39.4-1.el9_6 RLSA-2025:7389
Rocky Linux 9 podman 5:5.4.0-9.el9_6 RLSA-2025:7391
Rocky Linux 9 skopeo 2:1.18.1-1.el9_6 RLSA-2025:7397

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 apptainer 1.4.5-150600.4.12.1 SUSE-SU-2026:0439-1
SLES 15 SP7 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES 15 SP7 podman 4.9.5-150500.3.43.2 SUSE-RU-2025:02093-1
SLES 15 SP7 squashfuse 0.5.0-150600.3.2.1 SUSE-SU-2026:0439-1
SLES 15 SP6 apptainer 1.3.6-150600.4.9.1 SUSE-SU-2026:0439-1, SUSE-SU-2025:0980-1
SLES 15 SP6 buildah 1.35.5-150500.3.31.1 SUSE-SU-2026:2733-1, SUSE-SU-2025:1018-1, SUSE-SU-2025:0811-1
SLES 15 SP6 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
SLES 15 SP6 grafana 10.4.15-150200.3.69.1 SUSE-SU-2025:1011-1
SLES 15 SP6 podman 4.9.5-150500.3.37.1 SUSE-SU-2025:1038-1, SUSE-SU-2025:0785-1, SUSE-RU-2025:02093-1
SLES 15 SP6 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLES 15 SP6 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SLES 15 SP6 squashfuse 0.5.0-150600.3.2.1 SUSE-SU-2026:0439-1
SLES 15 SP5 buildah 1.35.5-150500.3.31.1 SUSE-SU-2026:2733-1, SUSE-SU-2025:1018-1, SUSE-SU-2025:0811-1
SLES 15 SP5 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
SLES 15 SP5 podman 4.9.5-150500.3.37.1 SUSE-SU-2025:1038-1, SUSE-SU-2025:0785-1, SUSE-RU-2025:02093-1
SLES 15 SP5 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLES 15 SP5 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SLES 15 SP4 buildah 1.35.5-150400.3.42.1 SUSE-SU-2026:2706-1, SUSE-SU-2025:1014-1, SUSE-SU-2025:0812-1
SLES 15 SP4 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
SLES 15 SP4 podman 4.9.5-150400.4.41.1 SUSE-SU-2025:1037-1, SUSE-SU-2025:0786-1, SUSE-RU-2025:02091-1
SLES 15 SP4 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLES 15 SP4 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SLES 15 SP3 buildah 1.35.5-150300.8.36.1 SUSE-SU-2025:1017-1, SUSE-SU-2025:0813-1
SLES 15 SP3 podman 4.9.5-150300.9.43.1 SUSE-SU-2025:1036-1, SUSE-SU-2025:0775-1, SUSE-RU-2025:02092-1
SLES 15 SP3 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
Show 20 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES for SAP 15 SP5 buildah 1.35.5-150500.3.31.1 SUSE-SU-2026:2733-1, SUSE-SU-2025:1018-1, SUSE-SU-2025:0811-1
SLES for SAP 15 SP5 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
SLES for SAP 15 SP5 podman 4.9.5-150500.3.37.1 SUSE-SU-2025:1038-1, SUSE-SU-2025:0785-1, SUSE-RU-2025:02093-1
SLES for SAP 15 SP5 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLES for SAP 15 SP5 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SLES for SAP 15 SP4 buildah 1.35.5-150400.3.42.1 SUSE-SU-2026:2706-1, SUSE-SU-2025:1014-1, SUSE-SU-2025:0812-1
SLES for SAP 15 SP4 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
SLES for SAP 15 SP4 podman 4.9.5-150400.4.41.1 SUSE-SU-2025:1037-1, SUSE-SU-2025:0786-1, SUSE-RU-2025:02091-1
SLES for SAP 15 SP4 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLES for SAP 15 SP4 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SLES for SAP 15 SP3 buildah 1.35.5-150300.8.36.1 SUSE-SU-2025:1017-1, SUSE-SU-2025:0813-1
SLES for SAP 15 SP3 podman 4.9.5-150300.9.43.1 SUSE-SU-2025:1036-1, SUSE-SU-2025:0775-1, SUSE-RU-2025:02092-1
SLES for SAP 15 SP3 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SLE Micro 6.1 podman 5.2.5-slfo.1.1_1.1 SUSE-SU-2025:20279-1
SLE Micro 6.1 skopeo 1.15.1-slfo.1.1_2.1 SUSE-SU-2025:20363-1
SLE Micro 6.0 podman 4.9.5-3.1 SUSE-SU-2026:22516-1, SUSE-SU-2025:20869-1, SUSE-SU-2025:20198-1
SLE Micro 6.0 skopeo 1.14.4-3.1 SUSE-SU-2025:20179-1
SLE Micro 5.5 podman 4.9.5-150500.3.37.1 SUSE-SU-2025:1038-1, SUSE-SU-2025:0785-1, SUSE-RU-2025:02093-1
SLE Micro 5.5 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SLE Micro 5.4 podman 4.9.5-150400.4.41.1 SUSE-SU-2025:1037-1, SUSE-SU-2025:0786-1, SUSE-RU-2025:02091-1
SLE Micro 5.3 podman 4.9.5-150400.4.41.1 SUSE-SU-2025:1037-1, SUSE-SU-2025:0786-1, SUSE-RU-2025:02091-1
SLE Micro 5.2 podman 4.9.5-150300.9.43.1 SUSE-SU-2025:1036-1, SUSE-SU-2025:0775-1, SUSE-RU-2025:02092-1
SLE Micro 5.1 podman 4.9.5-150300.9.43.1 SUSE-SU-2025:1036-1, SUSE-SU-2025:0775-1, SUSE-RU-2025:02092-1
SLE HPC 15 SP5 buildah 1.35.5-150500.3.31.1 SUSE-SU-2026:2733-1, SUSE-SU-2025:1018-1, SUSE-SU-2025:0811-1
SLE HPC 15 SP5 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
SLE HPC 15 SP5 podman 4.9.5-150500.3.37.1 SUSE-SU-2025:1038-1, SUSE-SU-2025:0785-1, SUSE-RU-2025:02093-1
SLE HPC 15 SP5 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLE HPC 15 SP5 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SLE HPC 15 SP4 buildah 1.35.5-150400.3.42.1 SUSE-SU-2026:2706-1, SUSE-SU-2025:1014-1, SUSE-SU-2025:0812-1
SLE HPC 15 SP4 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
SLE HPC 15 SP4 podman 4.9.5-150400.4.41.1 SUSE-SU-2025:1037-1, SUSE-SU-2025:0786-1, SUSE-RU-2025:02091-1
SLE HPC 15 SP4 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLE HPC 15 SP4 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SLE HPC 15 SP3 buildah 1.35.5-150300.8.36.1 SUSE-SU-2025:1017-1, SUSE-SU-2025:0813-1
SLE HPC 15 SP3 podman 4.9.5-150300.9.43.1 SUSE-SU-2025:1036-1, SUSE-SU-2025:0775-1, SUSE-RU-2025:02092-1
SLE HPC 15 SP3 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SUSE Package Hub 15 SP6 trivy 0.59.1-bp156.2.9.1 openSUSE-SU-2025:0080-1
SUSE Manager Server 4.3 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
SUSE Manager Server 4.3 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.15.2-150400.3.133.1 SUSE-SU-2025:01985-1
SUSE Manager Server 4.3 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SUSE Manager Proxy 4.3 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
SUSE Manager Proxy 4.3 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SUSE Manager Proxy 4.3 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
SUSE Manager Client Tools 15 grafana 10.4.15-150000.1.75.1 SUSE-SU-2025:1009-1
SUSE Manager Client Tools 12 grafana 10.4.15-1.75.1 SUSE-SU-2025:1010-1
SUSE Enterprise Storage 7.1 buildah 1.35.5-150300.8.36.1 SUSE-SU-2025:1017-1, SUSE-SU-2025:0813-1
SUSE Enterprise Storage 7.1 podman 4.9.5-150300.9.43.1 SUSE-SU-2025:1036-1, SUSE-SU-2025:0775-1, SUSE-RU-2025:02092-1
SUSE Enterprise Storage 7.1 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apptainer 1.3.6-5.1 openSUSE-SU-2025:14909-1
openSUSE Tumbleweed cosign 2.5.0-1.1 openSUSE-SU-2025:14988-1
openSUSE Tumbleweed gh 2.73.0-1.1 openSUSE-SU-2025:15158-1
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250312T181707-1.1 openSUSE-SU-2025:14889-1
openSUSE Tumbleweed grafana 11.5.2-1.1 openSUSE-SU-2025:14865-1
openSUSE Tumbleweed kubectl-retina 1.3.1-1.1 openSUSE-SU-2026:12297-1
openSUSE Tumbleweed podman 5.4.0-3.1 openSUSE-SU-2025:14871-1
openSUSE Tumbleweed rekor 1.3.10-1.1 openSUSE-SU-2025:14990-1
openSUSE Tumbleweed teleport 17.2.9-1.1 openSUSE-SU-2025:14839-1
openSUSE Tumbleweed traefik 3.4.3-1.1 openSUSE-SU-2025:15304-1
openSUSE Tumbleweed traefik2 2.11.26-1.1 openSUSE-SU-2025:15305-1
openSUSE Tumbleweed trivy 0.59.1-1.1 openSUSE-SU-2025:14840-1
openSUSE Tumbleweed velociraptor 0.7.0.4.git163.87ee3570-1.1 openSUSE-SU-2025:15307-1
openSUSE Tumbleweed vexctl 0.4.1+git78.f951e3a-1.1 openSUSE-SU-2026:10230-1
openSUSE Leap 16.0 gh 2.96.0-bp160.1.1 openSUSE-SU-2026:21310-1
openSUSE Leap 16.0 vexctl 0.4.4+git20.5d61136-160000.1.1 openSUSE-SU-2026:21481-1
openSUSE Leap 15.6 apptainer 1.3.6-150600.4.9.1 SUSE-SU-2026:0439-1, SUSE-SU-2025:0980-1
openSUSE Leap 15.6 buildah 1.35.5-150500.3.31.1 SUSE-SU-2025:1018-1, SUSE-SU-2025:0811-1
openSUSE Leap 15.6 cosign 2.5.0-150400.3.27.1 SUSE-SU-2025:1333-1
openSUSE Leap 15.6 grafana 10.4.15-150200.3.67.1 SUSE-SU-2025:1011-1
openSUSE Leap 15.6 podman 4.9.5-150500.3.37.1 SUSE-SU-2025:1038-1, SUSE-SU-2025:0785-1, SUSE-RU-2025:02093-1
openSUSE Leap 15.6 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
openSUSE Leap 15.6 skopeo 1.14.4-150300.11.19.1 SUSE-SU-2025:0772-1
openSUSE Leap 15.6 squashfuse 0.5.0-150600.3.2.1 SUSE-SU-2026:0439-1
openSUSE Leap 15.6 trivy 0.59.1-bp156.2.9.1 openSUSE-SU-2025:0080-1
openSUSE Leap 15.6 vexctl 0.4.1+git78.f951e3a-150000.1.11.1 SUSE-SU-2026:0592-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 containerd +1 1.7.27-1.amzn2023.0.2 ALAS2023-2025-930
Amazon Linux 2023 nerdctl 2.0.4-1.amzn2023.0.1 ALAS2023-2025-931
Amazon Linux 2023 runfinch-finch 1.7.1-1.amzn2023.0.1 ALAS2023-2025-914
Amazon Linux 2 nerdctl 2.0.4-1.amzn2.0.1 ALAS2-2025-2821

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 buildah 1.41.4-2 —
Azure Linux 3 cert-manager 1.12.15-2 —
Azure Linux 3 containerd 1.7.13-7 —
Azure Linux 3 containerd2 2.0.0-6 —
Azure Linux 3 containerized-data-importer 1.57.0-13 —
Azure Linux 3 cri-o No fix yet —
Azure Linux 3 dcos-cli 1.2.0-17 —
Azure Linux 3 gh 2.62.0-7 —
Azure Linux 3 ig 0.37.0-3 —
Azure Linux 3 influxdb 2.7.5-2 —
Azure Linux 3 keda 2.14.1-3 —
Azure Linux 3 kubernetes 1.30.10-3 —
Azure Linux 3 moby-containerd-cc 1.7.7-9 —
Azure Linux 3 packer 1.9.5-6 —
Azure Linux 3 podman 5.6.1-2 —
Azure Linux 3 skopeo 1.14.4-4 —
Azure Linux 3 telegraf 1.31.0-9 —
Azure Linux 2 (CBL-Mariner) cert-manager 1.11.2-20 —
Azure Linux 2 (CBL-Mariner) containerized-data-importer 1.55.0-23 —
Azure Linux 2 (CBL-Mariner) cri-o 1.22.3-12 —
Azure Linux 2 (CBL-Mariner) dcos-cli 1.2.0-20 —
Azure Linux 2 (CBL-Mariner) influxdb 2.6.1-21 —
Azure Linux 2 (CBL-Mariner) keda 2.4.0-27 —
Azure Linux 2 (CBL-Mariner) kube-vip-cloud-provider 0.0.2-20 —
Azure Linux 2 (CBL-Mariner) kubernetes 1.28.4-15 —
Azure Linux 2 (CBL-Mariner) moby-containerd 1.6.26-10 —
Azure Linux 2 (CBL-Mariner) moby-containerd-cc 1.7.7-11 —
Azure Linux 2 (CBL-Mariner) packer 1.9.5-10 —
Azure Linux 2 (CBL-Mariner) podman +1 No fix yet —
Azure Linux 2 (CBL-Mariner) rook 1.6.2-25 —
Azure Linux 2 (CBL-Mariner) skopeo 1.14.2-10 —
Azure Linux 2 (CBL-Mariner) telegraf 1.29.4-13 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 buildah +1 2:1.39.4-2.0.1.el10_0 ELSA-2025-7459
Oracle Linux 10 osbuild-composer +2 134.1-3.0.1.el10_0 ELSA-2025-19566
Oracle Linux 10 podman +3 6:5.4.0-10.0.1.el10_0 ELSA-2025-7462
Oracle Linux 10 skopeo +1 2:1.18.1-2.el10_0 ELSA-2025-7467
Oracle Linux 9 buildah +1 2:1.39.4-1.0.1.el9_6 ELSA-2025-7389
Oracle Linux 9 osbuild-composer +2 132.2-3.0.1.el9_6 ELSA-2025-19594
Oracle Linux 9 podman +4 5:5.4.0-9.0.1.el9_6 ELSA-2025-7391
Oracle Linux 9 skopeo +1 2:1.18.1-1.el9_6 ELSA-2025-7397

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r25 —
Wolfi rolling apko 0.25.1-r2 —
Wolfi rolling argo-workflows 3.6.4-r1 —
Wolfi rolling argocd-image-updater +1 0.15.2-r5 —
Wolfi rolling bank-vaults +1 1.20.4-r25 —
Wolfi rolling boring-registry 0.16.3-r1 —
Wolfi rolling buildah 1.39.0-r2 —
Wolfi rolling caddy +2 2.9.1-r5 —
Wolfi rolling cert-manager-istio-csr +1 0.14.0-r2 —
Wolfi rolling cosign 2.4.3-r1 —
Wolfi rolling ctr-1 +4 1.7.26-r1 —
Wolfi rolling ctr-2 +4 2.0.2-r4 —
Wolfi rolling dagdotdev 0.0.13-r1 —
Wolfi rolling dagger 0.16.1-r1 —
Wolfi rolling dex +1 2.42.0-r1 —
Wolfi rolling dgraph 24.0.5-r7 —
Wolfi rolling distribution 3.0.0-r7 —
Wolfi rolling falcoctl 0.11.0-r3 —
Wolfi rolling flux-source-controller +3 1.5.0-r1 —
Wolfi rolling flyte 1.15.0-r1 —
Wolfi rolling frp 0.61.1-r3 —
Wolfi rolling fulcio 1.6.6-r3 —
Wolfi rolling gatus +1 5.16.0-r1 —
Wolfi rolling gitsign +2 0.12.0-r5 —
Wolfi rolling gomplate 4.3.0-r5 —
Wolfi rolling goreleaser 2.7.0-r1 —
Wolfi rolling grafana-alloy 1.8.3-r1 —
Wolfi rolling grafana-mimir 2.15.0-r6 —
Wolfi rolling grpc-health-probe +1 0.4.37-r3 —
Wolfi rolling guac +4 0.13.2-r2 —
Wolfi rolling harbor-registry 3.0.0_alpha1-r24 —
Wolfi rolling hydra 2.3.0-r1 —
Wolfi rolling istio-pilot-agent-1.25 +1 1.25.0-r5 —
Wolfi rolling k3d +2 5.8.3-r1 —
Wolfi rolling k3s +2 1.32.1.1-r2 —
Wolfi rolling k3s-1.32 +2 1.32.6.1-r0 —
Wolfi rolling kargo +1 1.2.3-r1 —
Wolfi rolling kiali 2.18.0-r0 —
Wolfi rolling ko 0.17.1-r6 —
Wolfi rolling kots +2 1.124.4-r1 —
Wolfi rolling ksops +1 4.3.3-r2 —
Wolfi rolling kube-rbac-proxy 0.20.0-r1 —
Wolfi rolling kubescape 3.0.30-r1 —
Wolfi rolling kyverno-notation-aws +1 1.1-r5 —
Wolfi rolling kyverno-policy-reporter +1 3.1.4-r1 —
Wolfi rolling melange 0.21.1-r1 —
Wolfi rolling minio +1 0.20250203.210304-r1 —
Wolfi rolling nerdctl 2.0.3-r2 —
Wolfi rolling neuvector-scanner +2 3.795-r0 —
Wolfi rolling oauth2-proxy +1 7.8.1-r3 —
Wolfi rolling octo-sts +1 0.4.2-r6 —
Wolfi rolling openbao +1 2.1.1-r2 —
Wolfi rolling opentofu-1.9 1.9.0-r4 —
Wolfi rolling podman +1 5.4.0-r2 —
Wolfi rolling policy-controller +1 0.12.0-r3 —
Wolfi rolling pulumi +3 3.153.0-r1 —
Wolfi rolling rabbitmq-messaging-topology-operator +2 1.16.0-r1 —
Wolfi rolling rekor +3 1.3.9-r4 —
Wolfi rolling rook +1 1.16.4-r1 —
Wolfi rolling sftpgo 2.6.6-r1 —
Wolfi rolling sftpgo-plugin-kms 1.0.15-r1 —
Wolfi rolling sigstore-scaffolding +13 0.7.18-r5 —
Wolfi rolling skaffold 2.14.1-r1 —
Wolfi rolling skopeo 1.18.0-r1 —
Wolfi rolling sops 3.9.4-r2 —
Wolfi rolling spiffe-helper +1 0.9.1-r2 —
Wolfi rolling spire-agent +2 1.11.2-r2 —
Wolfi rolling spire-controller-manager +1 0.6.1-r1 —
Wolfi rolling splunk-otel-collector +2 0.119.0-r1 —
Wolfi rolling steampipe 1.1.3-r1 —
Wolfi rolling step 0.28.3-r1 —
Wolfi rolling step-ca 0.28.2-r1 —
Wolfi rolling step-issuer +1 0.9.7-r3 —
Wolfi rolling step-kms-plugin 0.12.1-r1 —
Wolfi rolling tekton-chains 0.24.0-r2 —
Wolfi rolling temporal +1 1.2.0-r3 —
Wolfi rolling temporal-ui-server +1 2.36.0-r3 —
Wolfi rolling terragrunt +1 0.76.1-r0 —
Wolfi rolling tflint +1 0.55.1-r2 —
Wolfi rolling timestamp-authority +2 1.2.4-r2 —
Wolfi rolling tkn 0.40.0-r1 —
Wolfi rolling traefik-3.3 3.3.3-r2 —
Wolfi rolling trivy 0.59.1-r1 —
Wolfi rolling trufflehog 3.88.12-r1 —
Wolfi rolling undock 0.9.0-r3 —
Wolfi rolling vault-benchmark +1 0.3.0-r5 —
Wolfi rolling vexctl 0.3.0-r6 —
Wolfi rolling weaviate 1.29.0-r1 —
Wolfi rolling wolfictl 0.29.4-r2 —
Wolfi rolling zarf 0.49.0-r2 —
Wolfi rolling zot 2.1.2-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/go-jose/go-jose < 3.0.4 3.0.4 GHSA-c6gw-w398-hv78
Go github.com/go-jose/go-jose all versions — GO-2025-3485
Go github.com/go-jose/go-jose/v3 < 3.0.4 3.0.4 GHSA-c6gw-w398-hv78
Go github.com/go-jose/go-jose/v4 < 4.0.5 4.0.5 GHSA-c6gw-w398-hv78
Go github.com/square/go-jose all versions — GO-2025-3485

Advisories 50

References