News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2025-22868 CVE High · CVSS 7.5 False Positive

go-jose: Memory Exhaustion via Malformed Token Parsing

This advisory does not affect KrakenD

The vulnerable JWS token parsing code path is part of KrakenD’s client credentials dependency but is not reachable from untrusted external input during normal KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.10.1 and EE 2.10.1.

Component

go-jose (go/jws)

Disclosed

Jun 19, 2025

CVSS Score

7.5

Description

The go/jws package (go-jose) before v0.27.0 does not properly validate the input size when parsing JWS tokens. A remotely supplied malformed token causes unbounded memory consumption during parsing, enabling a denial-of-service attack against any service that parses attacker-controlled tokens with the affected library. KrakenD’s client credentials component does not expose the affected JWS parsing path to untrusted input, making this a false positive for KrakenD.

References

View CVE-2025-22868 on NVD

Stay up to date with KrakenD releases and important updates