-
Notifications
You must be signed in to change notification settings - Fork 62
Closed
@mend-bolt-for-github
Description
CVE-2025-22868 - High Severity Vulnerability
Vulnerable Library - golang.org/x/oauth2-v0.10.0
Library home page: https://proxy.golang.org/golang.org/x/oauth2/@v/v0.10.0.zip
Path to dependency file: /engine/go.mod
Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/golang.org/x/oauth2/@v/v0.10.0.mod
Dependency Hierarchy:
- ❌ golang.org/x/oauth2-v0.10.0 (Vulnerable Library)
Found in base branch: master
Vulnerability Details
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
Publish Date: 2025年02月26日
URL: CVE-2025-22868
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pkg.go.dev/vuln/GO-2025-3488
Release Date: 2025年02月26日
Fix Resolution: v0.27.0
Step up your Open Source Security Game with Mend here