CVE catalog

CVE-2025-27144

Security update for buildah

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 25, 2026

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-go-jose-go-jose134.0.5-1fixed
Debiangolang-github-go-jose-go-jose144.0.5-1fixed
Opensusevelociraptortumbleweed0.7.0.4.git163.87ee3570-1.1fixed
Opensuseghtumbleweed2.73.0-1.1fixed
Opensusepodmantumbleweed5.4.0-3.1fixed
Susepodmanlinux enterprise micro 5.34.9.5-150400.4.41.1fixed
Susepodmanlinux enterprise micro 5.44.9.5-150400.4.41.1fixed
Susepodmanlinux enterprise high performance computing 15 sp4-espos4.9.5-150400.4.41.1fixed
Susepodmanlinux enterprise high performance computing 15 sp4-ltss4.9.5-150400.4.41.1fixed
Susepodmanlinux enterprise server 15 sp4-ltss4.9.5-150400.4.41.1fixed
Susepodmanlinux enterprise server for sap applications 15 sp44.9.5-150400.4.41.1fixed
Suseskopeolinux enterprise micro 5.51.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise module for basesystem 15 sp61.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise high performance computing 15 sp3-ltss1.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise high performance computing 15 sp4-espos1.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise high performance computing 15 sp4-ltss1.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise high performance computing 15 sp5-espos1.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise high performance computing 15 sp5-ltss1.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise server 15 sp3-ltss1.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise server 15 sp4-ltss1.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise server 15 sp5-ltss1.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise server for sap applications 15 sp31.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise server for sap applications 15 sp41.14.4-150300.11.19.1fixed
Suseskopeolinux enterprise server for sap applications 15 sp51.14.4-150300.11.19.1fixed
Suseskopeomanager proxy 4.31.14.4-150300.11.19.1fixed
Suseskopeomanager server 4.31.14.4-150300.11.19.1fixed
Suseskopeoenterprise storage 7.11.14.4-150300.11.19.1fixed
Opensuseskopeoleap 15.61.14.4-150300.11.19.1fixed
Susepodmanlinux enterprise micro 5.54.9.5-150500.3.37.1fixed
Susepodmanlinux enterprise module for containers 15 sp64.9.5-150500.3.37.1fixed
Susepodmanlinux enterprise high performance computing 15 sp5-espos4.9.5-150500.3.37.1fixed
Susepodmanlinux enterprise high performance computing 15 sp5-ltss4.9.5-150500.3.37.1fixed
Susepodmanlinux enterprise server 15 sp5-ltss4.9.5-150500.3.37.1fixed
Susepodmanlinux enterprise server for sap applications 15 sp54.9.5-150500.3.37.1fixed
Opensusepodmanleap 15.64.9.5-150500.3.37.1fixed
Susegrafanamanager client tools 1210.4.15-1.75.1fixed
Opensusegrafanatumbleweed11.5.2-1.1fixed
Susebuildahlinux enterprise high performance computing 15 sp4-espos1.35.5-150400.3.42.1fixed
Susebuildahlinux enterprise high performance computing 15 sp4-ltss1.35.5-150400.3.42.1fixed
Susebuildahlinux enterprise server 15 sp4-ltss1.35.5-150400.3.42.1fixed
Susebuildahlinux enterprise server for sap applications 15 sp41.35.5-150400.3.42.1fixed
Susegrafanamanager client tools 1510.4.15-150000.1.75.1fixed
Susetrivypackage hub 15 sp60.59.1-bp156.2.9.1fixed
Opensusetrivyleap 15.60.59.1-bp156.2.9.1fixed
Susegrafanalinux enterprise module for package hub 15 sp610.4.15-150200.3.69.1fixed
Opensusegrafanaleap 15.610.4.15-150200.3.67.1fixed
Susebuildahlinux enterprise module for containers 15 sp61.35.5-150500.3.31.1fixed
Susebuildahlinux enterprise high performance computing 15 sp5-espos1.35.5-150500.3.31.1fixed
Susebuildahlinux enterprise high performance computing 15 sp5-ltss1.35.5-150500.3.31.1fixed
Susebuildahlinux enterprise server 15 sp5-ltss1.35.5-150500.3.31.1fixed
Susebuildahlinux enterprise server for sap applications 15 sp51.35.5-150500.3.31.1fixed
Opensusebuildahleap 15.61.35.5-150500.3.31.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-go-jose-go-josedeb134.0.5-1Not reportedDEBIAN-CVE-2025-27144Not reported
Debiangolang-github-go-jose-go-josedeb144.0.5-1Not reportedDEBIAN-CVE-2025-27144Not reported
Opensusevelociraptorrpmtumbleweed0.7.0.4.git163.87ee3570-1.1Not reportedOPENSUSE-SU-2025:15307-1Not reported
Opensuseghrpmtumbleweed2.73.0-1.1Not reportedOPENSUSE-SU-2025:15158-1Not reported
Opensusepodmanrpmtumbleweed5.4.0-3.1Not reportedOPENSUSE-SU-2025:14871-1Not reported
Susepodmanrpmlinux enterprise micro 5.34.9.5-150400.4.41.1Not reportedSUSE-SU-2025:0786-1Not reported
Susepodmanrpmlinux enterprise micro 5.44.9.5-150400.4.41.1Not reportedSUSE-SU-2025:0786-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp4-espos4.9.5-150400.4.41.1Not reportedSUSE-SU-2025:0786-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp4-ltss4.9.5-150400.4.41.1Not reportedSUSE-SU-2025:0786-1Not reported
Susepodmanrpmlinux enterprise server 15 sp4-ltss4.9.5-150400.4.41.1Not reportedSUSE-SU-2025:0786-1Not reported
Susepodmanrpmlinux enterprise server for sap applications 15 sp44.9.5-150400.4.41.1Not reportedSUSE-SU-2025:0786-1Not reported
Suseskopeorpmlinux enterprise micro 5.51.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise module for basesystem 15 sp61.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise high performance computing 15 sp3-ltss1.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise high performance computing 15 sp4-espos1.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise high performance computing 15 sp4-ltss1.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise high performance computing 15 sp5-espos1.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise high performance computing 15 sp5-ltss1.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise server 15 sp3-ltss1.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise server 15 sp4-ltss1.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise server 15 sp5-ltss1.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise server for sap applications 15 sp31.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise server for sap applications 15 sp41.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmlinux enterprise server for sap applications 15 sp51.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmmanager proxy 4.31.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmmanager server 4.31.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Suseskopeorpmenterprise storage 7.11.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Opensuseskopeorpmleap 15.61.14.4-150300.11.19.1Not reportedSUSE-SU-2025:0772-1Not reported
Susepodmanrpmlinux enterprise micro 5.54.9.5-150500.3.37.1Not reportedSUSE-SU-2025:0785-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp64.9.5-150500.3.37.1Not reportedSUSE-SU-2025:0785-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp5-espos4.9.5-150500.3.37.1Not reportedSUSE-SU-2025:0785-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp5-ltss4.9.5-150500.3.37.1Not reportedSUSE-SU-2025:0785-1Not reported
Susepodmanrpmlinux enterprise server 15 sp5-ltss4.9.5-150500.3.37.1Not reportedSUSE-SU-2025:0785-1Not reported
Susepodmanrpmlinux enterprise server for sap applications 15 sp54.9.5-150500.3.37.1Not reportedSUSE-SU-2025:0785-1Not reported
Opensusepodmanrpmleap 15.64.9.5-150500.3.37.1Not reportedSUSE-SU-2025:0785-1Not reported
Susegrafanarpmmanager client tools 1210.4.15-1.75.1Not reportedSUSE-SU-2025:1010-1Not reported
Opensusegrafanarpmtumbleweed11.5.2-1.1Not reportedOPENSUSE-SU-2025:14865-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp4-espos1.35.5-150400.3.42.1Not reportedSUSE-SU-2025:0812-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp4-ltss1.35.5-150400.3.42.1Not reportedSUSE-SU-2025:0812-1Not reported
Susebuildahrpmlinux enterprise server 15 sp4-ltss1.35.5-150400.3.42.1Not reportedSUSE-SU-2025:0812-1Not reported
Susebuildahrpmlinux enterprise server for sap applications 15 sp41.35.5-150400.3.42.1Not reportedSUSE-SU-2025:0812-1Not reported
Susegrafanarpmmanager client tools 1510.4.15-150000.1.75.1Not reportedSUSE-SU-2025:1009-1Not reported
Susetrivyrpmpackage hub 15 sp60.59.1-bp156.2.9.1Not reportedOPENSUSE-SU-2025:0080-1Not reported
Opensusetrivyrpmleap 15.60.59.1-bp156.2.9.1Not reportedOPENSUSE-SU-2025:0080-1Not reported
Susegrafanarpmlinux enterprise module for package hub 15 sp610.4.15-150200.3.69.1Not reportedSUSE-SU-2025:1011-1Not reported
Opensusegrafanarpmleap 15.610.4.15-150200.3.67.1Not reportedSUSE-SU-2025:1011-1Not reported
Susebuildahrpmlinux enterprise module for containers 15 sp61.35.5-150500.3.31.1Not reportedSUSE-SU-2025:0811-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp5-espos1.35.5-150500.3.31.1Not reportedSUSE-SU-2025:0811-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp5-ltss1.35.5-150500.3.31.1Not reportedSUSE-SU-2025:0811-1Not reported
Susebuildahrpmlinux enterprise server 15 sp5-ltss1.35.5-150500.3.31.1Not reportedSUSE-SU-2025:0811-1Not reported
Susebuildahrpmlinux enterprise server for sap applications 15 sp51.35.5-150500.3.31.1Not reportedSUSE-SU-2025:0811-1Not reported
Opensusebuildahrpmleap 15.61.35.5-150500.3.31.1Not reportedSUSE-SU-2025:0811-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [gh-bash-completion]Unknown

    Source package: [gh]

    Details (1)

    • 2.98.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.73.0-1.1

      Version impact unknown

      pypi · gh · opensuse · tumbleweed

  • [gh-fish-completion]Unknown

    Source package: [gh]

    Details (1)

    • 2.98.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.73.0-1.1

      Version impact unknown

      pypi · gh · opensuse · tumbleweed

  • [gh-zsh-completion]Unknown

    Source package: [gh]

    Details (1)

    • 2.98.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.73.0-1.1

      Version impact unknown

      pypi · gh · opensuse · tumbleweed

  • [podman-docker]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 5.4.0-3.1

      Version impact unknown

      pypi · podman · opensuse · tumbleweed

  • [podman-remote]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.4.0-3.1

      Version impact unknown

      pypi · podman · opensuse · tumbleweed

  • [podmansh]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.4.0-3.1

      Version impact unknown

      pypi · podman · opensuse · tumbleweed

  • [gh]Fixed

    Source package: [gh]

    Details (1)

    • 2.98.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 2.73.0-1.1

      pypi · gh · opensuse · tumbleweed

  • [grafana]Fixed

    Source package: [grafana]

    Details (1)

    • 12.4.5-4.1 · x86_64 · tumbleweed

      Fixed · Fixed: 11.5.2-1.1

      pypi · grafana · opensuse · tumbleweed

  • [podman]Fixed

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 5.4.0-3.1

      pypi · podman · opensuse · tumbleweed

  • [velociraptor]Fixed

    Source package: [velociraptor]

    Details (1)

    • 0.7.0.4.git185.a5708584-2.3 · x86_64 · tumbleweed

      Fixed · Fixed: 0.7.0.4.git163.87ee3570-1.1

      pypi · velociraptor · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [golang-github-go-jose-go-jose-dev]Fixed

    Source package: [golang-github-go-jose-go-jose]

    Details (4)

    • 4.0.5-1 · all · trixie

      Fixed · Fixed: 4.0.5-1

      pypi · golang-github-go-jose-go-jose · debian · 13

    • 4.0.5-1 · all · trixie

      Fixed · Fixed: 4.0.5-1

      pypi · golang-github-go-jose-go-jose · debian · 13

    • 4.1.4-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 4.0.5-1

      pypi · golang-github-go-jose-go-jose · debian · 13

    • 4.1.4-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 4.0.5-1

      pypi · golang-github-go-jose-go-jose · debian · 13

  • [jose-util]Fixed

    Source package: [golang-github-go-jose-go-jose]

    Details (4)

    • 4.0.5-1+b3 · amd64 · trixie

      Fixed · Fixed: 4.0.5-1

      pypi · golang-github-go-jose-go-jose · debian · 13

    • 4.0.5-1+b3 · arm64 · trixie

      Fixed · Fixed: 4.0.5-1

      pypi · golang-github-go-jose-go-jose · debian · 13

    • 4.1.4-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 4.0.5-1

      pypi · golang-github-go-jose-go-jose · debian · 13

    • 4.1.4-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 4.0.5-1

      pypi · golang-github-go-jose-go-jose · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]