The chaos-operator go.mod currently has golang.org/x/oauth2 v0.7.0 // indirect.
|
golang.org/x/oauth2 v0.7.0 // indirect |
That version is affected by CVE-2025-22868 (improper validation / unexpected memory consumption when parsing malformed tokens; CVSS 7.5 High).
Fix: Upgrade to golang.org/x/oauth2@v0.27.0 (or later).
The chaos-operator go.mod currently has golang.org/x/oauth2 v0.7.0 // indirect.
chaos-operator/go.mod
Line 12 in 01a76ca
That version is affected by CVE-2025-22868 (improper validation / unexpected memory consumption when parsing malformed tokens; CVSS 7.5 High).
Fix: Upgrade to golang.org/x/oauth2@v0.27.0 (or later).