Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
CVE: CVE-2025-22868
Component: golang.org/x/oauth2/jws
CWE: CWE-1286
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-26T03:07:49.012000+00:00

A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
If you are using an earlier version of RHACS 4.5, you are advised to upgrade to patch release 4.5.8.
If you are using an earlier version of RHACS 4.5, you are advised to upgrade to patch release 4.5.7.
If you are using an earlier version of RHACS 4.6, you are advised to upgrade to patch release 4.6.3.
If you are using an earlier version of RHACS 4.6, you are advised to upgrade to this patch release 4.6.4.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:133fd703b5a550fc5be350af24597e0f07c83d7a4b0edfd3d24772342c572e84

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:c71d99a4996a4d09e5005a0045a7de7b3fe316080e5fc3a26619f7010dd70d0e

      (For s390x architecture)
      The image digest is sha256:5aaebef8f79bbe32d1b9eed094cfabd47a69e601290df434bdc3223c577f953f

      (For ppc64le architecture)
      The image digest is sha256:a189ab95534f40cd2e4d5b29aab9e1ee370b518f3c592344e0d449debf976600

      (For aarch64 architecture)
      The image digest is sha256:daa4d609254247877b698076a3120b215c1b1043f6ece8eed81235885d030e27

All OpenShift Container Platform 4.14 users are advised to upgrade to these
updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:aa5f0d1f11da363b48c2ae1e1827ea4f1b4a05e33b0f10d9d6f48bea9037b76d

      (For s390x architecture)
      The image digest is sha256:78229709209cb169a43716f0094a7bf2dc6943c3938bd69a310fe768ad8925be

      (For ppc64le architecture)
      The image digest is sha256:a36bbb7ed6b351dddf76e53723bd2125f70fdfcf62abf416e8cf57151a825c51

      (For aarch64 architecture)
      The image digest is sha256:5f6f48c0b7bb083c05a3216cbb3c6e5e883889d74187fc7d7897d5a8d5a011c4

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html/clusters/cluster_mce_overview#mce-install-intro
For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html/clusters/cluster_mce_overview#mce-install-intro
For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/clusters/cluster_mce_overview#mce-install-intro
For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/clusters/cluster_mce_overview#mce-install-intro
For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To learn more about Submariner, see https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/networking/networking#submariner.
Before applying this update, make sure all previously released erratas are
relevant and have been applied to your system.
Before applying this update, make sure all previously released erratas are
relevant and have been applied to your system.
To learn more about Submariner, see https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/networking/networking#submariner.
For more details, see the Red Hat Advanced Cluster Management for Kubernetes
documentation:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/business_continuity/business-cont-overview#volsync
For more details, see the Red Hat Advanced Cluster Management for Kubernetes
documentation:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/business_continuity/business-cont-overview#volsync
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:bc37f63e71665274a0e71baa8013f21ee67f163480fced1eeab843b3ab25196d

      (For s390x architecture)
      The image digest is sha256:6036b7e534e0c8ba945c8d2834481b8ba6f757df43bdfeea99260bf4cab41464

      (For ppc64le architecture)
      The image digest is sha256:bbe85d19b9aac202abbf3ea1c59b3558687e7070e112b69eda129ad1b142640f

      (For aarch64 architecture)
      The image digest is sha256:78cadd2e791091f428a78e039daa78c8af4b8d588cbe7d9970ee1396d19340e8

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:7039e7bd34fd024ff619df914528c8d85e62b847291f6684096fd4ca8dba2bbd

      (For s390x architecture)
      The image digest is sha256:33318c1d550a6c846aac2d6852db0d922a500128586112166f0436ec45140fc4

      (For ppc64le architecture)
      The image digest is sha256:ec57410a29273bae8ba9b0024b6214c8ecb5140b032a361f49f1c3c19857affa

      (For aarch64 architecture)
      The image digest is sha256:3f39cb294260147d8a7128cf1446bc27cf049851d860425d9903f2c11e9f15b4

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:3ff7652a165409a368a7cdc748c95efc17db0761d467cc85fb355cce14643602

      (For s390x architecture)
      The image digest is sha256:e719d7719f466aa7584d8776d3f04ced742f5b2f7884fd1a8cb8f6cff259cbab

      (For ppc64le architecture)
      The image digest is sha256:3c3a437578260fde80a5b9b0a5513d4e016984156c0aa9d361b783ac142d9587

      (For aarch64 architecture)
      The image digest is sha256:b086a8cedd201aee39e244dd7892d44aa39fc262693a8ea199f14b908018d614

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:2fa965ede9ab6530be8a2e780b484d487c2b3ea4354e84cec680c22823c255ab

      (For s390x architecture)
      The image digest is sha256:8e59e0fe81ef2928aeae8f2ec07fa7953d50c32bc73ddd8596b784027f2aa2e1

      (For ppc64le architecture)
      The image digest is sha256:c8cfaa3eace6cf14df1cbcc0f9233db687b604416828f561b899a7b653c60a77

      (For aarch64 architecture)
      The image digest is sha256:53e34991043e4f76b4c4f6b604205a1c37918367e674c8350567da5794bc4619

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:f41be65a929742f584bb4299dfa48135b093b3cc86dc76c3ab77265574bdd4fe

      (For s390x architecture)
      The image digest is sha256:1fb74752e79c7fc248548dd16c60820c3ef2a7350782bbd6aec452e63f4ba9c2

      (For ppc64le architecture)
      The image digest is sha256:e3e5c701997d1e3294405f9d21e90d8ebb977e05ec99efd30d9613df93c6013f

      (For aarch64 architecture)
      The image digest is sha256:27dfa2840fce419526d7162992920367c4ae05b3a2a8ca412649fda4ff1de980

All OpenShift Container Platform 4.16 users are advised to upgrade to these
updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:0c2421a241e95f56895906885e7f7e53cb1520ee6a82db5cdeea98f5f65457d7

      (For s390x architecture)
      The image digest is sha256:542000db3d3c126ab0c88f24e7e238de66a743026b95b603d311204dcb36132e

      (For ppc64le architecture)
      The image digest is sha256:7482c48c0cdefbe9f88e0ddd748a6f00e1d2cc1fbd395a8270425a48d758a0c2

      (For aarch64 architecture)
      The image digest is sha256:930640a1fabd9bd84756bd35e5e5518e3e5576d5a22954698b6456729fb996e8

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:20bf36ab093f1da58dc9662f6cd132803babe641b7471553d2cd6a929bdfc946

      (For s390x architecture)
      The image digest is sha256:dfef87cb5d0e6d86c4d1fdcbc10711625b621ea4b9b2ae1a9dbbb211197e1f46

      (For ppc64le architecture)
      The image digest is sha256:395d04f9b79b09b2fbd7377f25ef927b81da984095aaf39d285206b451a1b683

      (For aarch64 architecture)
      The image digest is sha256:c747886ef9befb315b20c99f29a39b10cbd07684a874aee15a5e777aaae50442

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:0dac222584991f89a123d85e8c3055f0056e5876fc209b8d4bea7a59e7504d59

      (For s390x architecture)
      The image digest is sha256:33f8af4513fc5394c3210f5a3b447f4920cc9bd099830479d05f3799ae80f0a5

      (For ppc64le architecture)
      The image digest is sha256:8e522017e74e046cf57a76545fe6cc2cd742a79ff17bc22d66eee5126e5907c4

      (For aarch64 architecture)
      The image digest is sha256:12d59fd82eb938b06896679cc9a821651a2b05fdf74d0d23e528977f0fb11461

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:78c0475ba249e03b0ed5b3d3cca619020a2996fb75efb9e7b5a2d5972fbdac7c

      (For s390x architecture)
      The image digest is sha256:78c0475ba249e03b0ed5b3d3cca619020a2996fb75efb9e7b5a2d5972fbdac7c

      (For ppc64le architecture)
      The image digest is sha256:b8fd429a9b3013450a156c636e7e6569f5c1ecf95a8cfa5d2554275a9665054b

      (For aarch64 architecture)
      The image digest is sha256:57e7ac3ce11ec15b2e1ca16ecbe06e903a6699cdd7a0bc4d2720128c71138959

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:3482dbdce3a6fb2239684d217bba6fc87453eff3bdb72f5237be4beb22a2160b

      (For s390x architecture)
      The image digest is sha256:3bb1850f4d09ad42d29b6c08d9e37826f94bd5553dc63ab0ba8af808c4674fd2

      (For ppc64le architecture)
      The image digest is sha256:c0ccf9abb281831b019fb0f2967de9ced0b56259313020b3787f72038f2dbd14

      (For aarch64 architecture)
      The image digest is sha256:9ab7debef422a7d96278d3df314c92b3d842409928aa9a0d960cd2e94529a8b6

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/
For more information, see the following resources:

* See the Gatekeeper
documentation: https://open-policy-agent.github.io/gatekeeper/website/docs/.

* For support and troubleshooting, Gatekeeper is supported through a Red Hat Advanced Cluster Management for
Kubernetes subscription:
https://access.redhat.com/products/red-hat-advanced-cluster-management-for-kubernetes.

* The Open Policy Agent Gatekeeper community collaborates on Slack. Join the 
#opa-gatekeeper channel: https://openpolicyagent.slack.com/archives/CDTN970AX.

* Open issues on the Gatekeeper GitHub repository: https://github.com/open-policy-agent/gatekeeper/issues.

* See the installation and upgrade documentation: https://open-policy-agent.github.io/gatekeeper/website/docs/install.
For more information, see the following resources:

* See the Gatekeeper
documentation: https://open-policy-agent.github.io/gatekeeper/website/docs/.

* For support and troubleshooting, Gatekeeper is supported through a Red Hat Advanced Cluster Management for
Kubernetes subscription:
https://access.redhat.com/products/red-hat-advanced-cluster-management-for-kubernetes.

* The Open Policy Agent Gatekeeper community collaborates on Slack. Join the 
#opa-gatekeeper channel: https://openpolicyagent.slack.com/archives/CDTN970AX.

* Open issues on the Gatekeeper GitHub repository: https://github.com/open-policy-agent/gatekeeper/issues.

* See the installation and upgrade documentation: https://open-policy-agent.github.io/gatekeeper/website/docs/install.
Before applying this update, make sure all previously released erratas are
relevant and have been applied to your system.
Before applying this update, make sure all previously released erratas are
relevant and have been applied to your system.

See the multicluster global hub product documentation for more information:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html-single/multicluster_global_hub/index
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes

For Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:

https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ocp-4-19-release-notes

For Red Hat OpenShift Logging 6.3, see the following instructions to apply this update:

https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.3
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes

For Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:

https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0
For more information visit https://access.redhat.com/errata/RHSA-2025:23080
For more information visit https://access.redhat.com/errata/RHSA-2025:23202
For more information visit https://access.redhat.com/errata/RHSA-2025:23204
For more information visit https://access.redhat.com/errata/RHSA-2025:23078
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
For more information visit https://access.redhat.com/errata/RHSA-2025:23079
For more information visit https://access.redhat.com/errata/RHSA-2025:23449
For more information visit https://access.redhat.com/errata/RHSA-2025:23205
For more information visit https://access.redhat.com/errata/RHSA-2025:23209
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
For Red Hat OpenShift AI 2.19.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:61b4941f76aeed8f65735643d96a6cd4a823018cb7ca40d6966dd098bc8dc284

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:32f55a5ff24713e240a293ced4f8cb202bbdf482095593e226d1ea4397fefe8e


All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
Red Hat OpenShift Pipelines is a cloud-native, continuous integration and
continuous delivery (CI/CD) solution based on Kubernetes resources.
It uses Tekton building blocks to automate deployments across multiple
platforms by abstracting away the underlying implementation details.
Tekton introduces a number of standard custom resource definitions (CRDs)
for defining CI/CD pipelines that are portable across Kubernetes distributions.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.15/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.16/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.18/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index
To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.