Go/golang.org/x/oauth2 CVE-2025-22868: high 7.5, EPSS 0.87%

Unexpected memory consumption during token parsing in golang.org/x/oauth2

Action: Upgrade golang.org/x/oauth2 to 0.27.0 or later.

go get golang.org/x/oauth2@v0.27.0

Affected

Fixed versions

Sources

• osv: GO-2025-3488
• nvd: CVE-2025-22868
• https://go.dev/cl/652155
• https://go.dev/issue/71490

CVE-2025-22868 · published 2025-02-26T02:51:51Z · modified 2026-03-24T23:55:16.543914Z · JSON