{"id":"CVE-2025-22868","aliases":["GHSA-6v2p-p543-phr9","GO-2025-3488"],"title":"golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability","summary":"golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"x","product":"golang.org/x/oauth2","ecosystem":"go","affected":["golang.org/x/oauth2 < 0.27.0"],"patched":["golang.org/x/oauth2 0.27.0"],"published":"2025-07-18","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:26.016569187Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6v2p-p543-phr9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22868"},{"url":"https://go.dev/cl/652155"},{"url":"https://go.dev/issue/71490"},{"url":"https://pkg.go.dev/vuln/GO-2025-3488"}],"tags":["osv","go"],"epss":0.0087,"epssPercentile":0.57265,"ingestedAt":"2026-09-12T03:13:01.760Z","slug":"CVE-2025-22868","body":"## Overview\n\nAn attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.\n\n## Affected packages\n\n- `golang.org/x/oauth2 < 0.27.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `golang.org/x/oauth2 0.27.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}