CVE-2026-32269 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value ...

CLEANSTART-2026-DN29911 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Security vulnerability affects the clickhouse-operator package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

CLEANSTART-2026-ZR62045 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the clickhouse-operator package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

CLEANSTART-2026-JM16286 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the clickhouse-operator package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Denial of Service (DoS) due to malformed token parsing in golang.org/x/oauth2 module (CVE-2025-22868)

Summary Potential vulnerabilities in golang.org/x/oauth2 module CVE-2025-22868 have been identified that may affect IBM Cloud Pak for Data Vulnerability Details CVEID:CVE-2025-22868 DESCRIPTION: An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2025-32415 DESCRIPTION: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploi...

Security Bulletin: Malformed Token Parsing Vulnerability Leads to Unexpected Memory Consumption, which affects IBM watsonx.data

Summary An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. These can affect watsonx.data. Vulnerability Details CVEID:CVE-2025-22868 DESCRIPTION: An attacker can pass a malicious malformed token which causes unexpected memory to be...

golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

Important: docker

Issue Overview: An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. CVE-2025-22868 SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or no...

Amazon Linux 2023 : docker (ALAS2023-2025-934)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-934 advisory. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. CVE-2025-22868 SSH servers which implement file transfer protocols are vulnerable ...

CVE-2025-22868

A flaw was found in the golang.org/x/oauth2/jws package in the token parsing component. This vulnerability is made possible because of the use of strings.Splittoken, "." to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large...

SUSE CVE-2025-22868

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57309 CVE-2025-22868 affecting package azcopy for versions less than 10.25.1-2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

DEBIAN-CVE-2025-22868

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57324 CVE-2025-22868 affecting package vitess for versions less than 19.0.4-5

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57335 CVE-2025-22868 affecting package prometheus for versions less than 2.45.4-10

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57389 CVE-2025-22868 affecting package telegraf for versions less than 1.31.0-7

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57306 CVE-2025-22868 affecting package kubernetes for versions less than 1.30.10-3

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57410 CVE-2025-22868 affecting package node-problem-detector for versions less than 0.8.17-6

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57315 CVE-2025-22868 affecting package node-problem-detector for versions less than 0.8.20-2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...