Golang OAuth2 Library JWS Token Parsing Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Golang OAuth2 library, specifically in the JWS (JSON Web Signature) component, prior to version 0.27.0. The issue arises when an attacker passes a maliciously crafted token, leading to unexpected memory consumption during the token parsing process.

Impact

Exploitation of this vulnerability causes excessive memory usage, which can lead to a denial-of-service condition by causing the application to become unresponsive or to crash.

Remediation

Users can upgrade to Golang OAuth2 library version 0.27.0 or later to address this vulnerability.