Skip to content

NO-ISSUE: Update module github.com/openshift/golang-oauth2 to v0.28.0 #757

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
red-hat-konflux wants to merge 1 commit into
base: master
Choose a base branch
from
+14 −10
Open

NO-ISSUE: Update module github.com/openshift/golang-oauth2 to v0.28.0 #757

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ replace (
github.com/openshift/cluster-api-provider-agent/api => ./api
// CVE-2025-22868
// This is from tag v0.26.openshift.1
golang.org/x/oauth2 => github.com/openshift/golang-oauth2 v0.26.1-0.20250310184649-06a918c6239d
golang.org/x/oauth2 => github.com/openshift/golang-oauth2 v0.28.0
Copy link

@coderabbitai coderabbitai bot Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

CVE-2025-22868 golang oauth2 security vulnerability

💡 Result:

CVE-2025-22868 (Go / golang.org/x/oauth2) is a Denial-of-Service (DoS) issue where a malicious, malformed token can trigger unexpected/unbounded memory consumption during token parsing. [1][2]

  • Affected component: golang.org/x/oauth2/jws (in the golang.org/x/oauth2 module) before v0.27.0. [1][3]
  • Severity: HIGH (CVSS 3.1 7.5), network exploitable, no privileges or user interaction required; availability impact is high. [2][3]
  • Fix: Upgrade golang.org/x/oauth2 to v0.27.0 or later (contains the patch). [1][3]

What to do

  1. Update your dependency (example): 
    go get golang.org/x/oauth2@v0.27.0
go mod tidy
  2. If you accept tokens from untrusted sources, consider adding request/body size limits and rate limiting as defense-in-depth (the core fix is upgrading). [1][2]

Sources
[1] Go vulnerability report (GO-2025-3488) https://pkg.go.dev/vuln/GO-2025-3488
[2] NVD entry https://nvd.nist.gov/vuln/detail/CVE-2025-22868
[3] GitHub Advisory (GHSA-6v2p-p543-phr9) GHSA-6v2p-p543-phr9

🏁 Script executed:

# Check the go.mod file context around line 149
cd . && head -n 160 go.mod | tail -n 25

Repository: openshift/cluster-api-provider-agent

Length of output: 1261

🌐 Web query:

github.com/openshift/golang-oauth2 v0.28.0 release

💡 Result:

I couldn’t find any publicly indexed GitHub “Release” (or even a discoverable repository page) for github.com/openshift/golang-oauth2 or a v0.28.0 release/tag in that OpenShift org—search results consistently resolve only to the upstream golang/oauth2 project, not an OpenShift fork. [2]

For the upstream module golang.org/x/oauth2, tag v0.28.0 corresponds to a change titled “Deep copy context client in NewClient” (so client settings like timeouts from a context-provided *http.Client are preserved instead of being lost). The tag was committed on March 3, 2025. [1]

Sources:
[1] v0.28.0 tag details (commit message/date) on Chromium’s mirror of golang/oauth2: (chromium.googlesource.com)
[2] Upstream GitHub repository (no OpenShift fork/release surfaced in search): (github.com)

Citations:

Cannot verify the OpenShift fork version publicly—confirm the security fix is present.

The replace directive points to github.com/openshift/golang-oauth2 v0.28.0, which claims to address CVE-2025-22868 (a HIGH-severity DoS in golang.org/x/oauth2/jws). However, the OpenShift fork tag v0.28.0 cannot be verified publicly via GitHub—no release or tag is discoverable.

While the upstream golang.org/x/oauth2 v0.28.0 exists (released March 3, 2025) and would contain the fix, this change uses a fork without clear documentation. Before merging:

  • Verify the fork tag v0.28.0 exists and includes the CVE-2025-22868 patch
  • Document why the OpenShift fork is necessary (e.g., additional patches)
  • If the fork is only for CVE-2025-22868, consider using the upstream v0.27.0+ directly instead
🤖 Prompt for AI Agents 
In `@go.mod` at line 149, The go.mod replace pointing to
github.com/openshift/golang-oauth2 v0.28.0 must be validated and justified:
verify that the OpenShift fork tag v0.28.0 actually exists and contains the
CVE-2025-22868 patch (inspect the fork repo/commit history for the jws fix), and
then either (a) add documentation in the PR/CHANGELOG explaining why the
OpenShift fork is required (what additional patches/behavior it provides) or (b)
if the fork only supplies the CVE fix, change the replace to use the upstream
golang.org/x/oauth2 v0.28.0 (or the minimal upstream v0.27.x+ release that
includes the patch) instead; update go.mod accordingly and run go mod tidy to
ensure builds resolve.


sigs.k8s.io/cluster-api => sigs.k8s.io/cluster-api v1.11.0
)
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -367,8 +367,8 @@ github.com/openshift/assisted-service/models v0.0.0-20251208131030-ae39457e926d
github.com/openshift/assisted-service/models v0.0.0-20251208131030-ae39457e926d/go.mod h1:5EkIueBSaLnt64HR8drgSewdm+GeuE7W5mr9pa2JXXk=
github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87 h1:cHyxR+Y8rAMT6m1jQCaYGRwikqahI0OjjUDhFNf3ySQ=
github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87/go.mod h1:DB/Mf2oTeiAmVVX1gN+NEqweonAPY0TKUwADizj8+ZA=
github.com/openshift/golang-oauth2 v0.26.1-0.20250310184649-06a918c6239d h1:iQfTKBmMcwFTxxVWV7U/C6GqgIIWTKD8l5HXslvn53s=
github.com/openshift/golang-oauth2 v0.26.1-0.20250310184649-06a918c6239d/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
github.com/openshift/golang-oauth2 v0.28.0 h1:3lcktQl0+nplVotPrWVK6m24GJZyx+Ls2oE+fJ+3PPM=
github.com/openshift/golang-oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
github.com/openshift/hive/apis v0.0.0-20260127213836-e33d70397d57 h1:Jk9HVqFTkNNxCB4gaCMaDH4bAYsPuFTwbiPGJy2bKg4=
github.com/openshift/hive/apis v0.0.0-20260127213836-e33d70397d57/go.mod h1:20tnfMYPSXqVDypUaO2vmxOtFzWj5l2KdZ+zYENpycI=
github.com/pin/tftp v2.1.0+incompatible/go.mod h1:xVpZOMCXTy+A5QMjEVN0Glwa1sUvaJhFXbr/aAxuxGY=
Expand Down
8 changes: 6 additions & 2 deletions vendor/golang.org/x/oauth2/oauth2.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions vendor/golang.org/x/oauth2/pkce.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions vendor/modules.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,8 +377,8 @@ golang.org/x/net/http2
golang.org/x/net/http2/hpack
golang.org/x/net/idna
golang.org/x/net/internal/httpcommon
# golang.org/x/oauth2 v0.33.0 => github.com/openshift/golang-oauth2 v0.26.1-0.20250310184649-06a918c6239d
## explicit; go 1.18
# golang.org/x/oauth2 v0.33.0 => github.com/openshift/golang-oauth2 v0.28.0
## explicit; go 1.23.0
golang.org/x/oauth2
golang.org/x/oauth2/internal
# golang.org/x/sync v0.18.0
Expand Down Expand Up @@ -1018,5 +1018,5 @@ sigs.k8s.io/yaml
# github.com/openshift/assisted-service/api => github.com/openshift/assisted-service/api v0.0.0-20251209011235-28a9e58dea34
# github.com/openshift/assisted-service/models => github.com/openshift/assisted-service/models v0.0.0-20251208131030-ae39457e926d
# github.com/openshift/cluster-api-provider-agent/api => ./api
# golang.org/x/oauth2 => github.com/openshift/golang-oauth2 v0.26.1-0.20250310184649-06a918c6239d
# golang.org/x/oauth2 => github.com/openshift/golang-oauth2 v0.28.0
# sigs.k8s.io/cluster-api => sigs.k8s.io/cluster-api v1.11.0