Case Study How Showpo Rebuilt Its API Layer for a Global Headless Migration

CVE-2025-22868 High · CVSS 7.5 False Positive

go-jose: Memory Exhaustion via Malformed Token Parsing

This CVE does not affect KrakenD

The vulnerable JWS token parsing code path is part of KrakenD’s client credentials dependency but is not reachable from untrusted external input during normal KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.10.1 and EE 2.10.1.

Component

go-jose (go/jws)

Disclosed

Jun 19, 2025

CVSS Score

7.5

Description

The go/jws package (go-jose) before v0.27.0 does not properly validate the input size when parsing JWS tokens. A remotely supplied malformed token causes unbounded memory consumption during parsing, enabling a denial-of-service attack against any service that parses attacker-controlled tokens with the affected library. KrakenD’s client credentials component does not expose the affected JWS parsing path to untrusted input, making this a false positive for KrakenD.

References

View CVE-2025-22868 on NVD

Stay up to date with KrakenD releases and important updates