Vulnerability · Published Mar 21, 2025 · Assigned by GitHub_M
CVE-2025-30204jwt-go allows excessive memory allocation during header parsing
High 7.5
In plain English
A high-severity security flaw in jwt from golang-jwt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | grafana | 10.2.6-15.el10_0 | ALSA-2025:7475 |
| AlmaLinux:9 | grafana | 10.2.6-11.el9_6 | ALSA-2025:7404 |
| AlmaLinux:9 | grafana | 10.2.6-9.el9_5 | ALSA-2025:3344 |
| AlmaLinux:10 | grafana-selinux | 10.2.6-15.el10_0 | ALSA-2025:7475 |
| AlmaLinux:9 | grafana-selinux | 10.2.6-11.el9_6 | ALSA-2025:7404 |
| AlmaLinux:9 | grafana-selinux | 10.2.6-9.el9_5 | ALSA-2025:3344 |
| AlmaLinux:8 | osbuild-composer | 101-3.el8_10.alma.1 | ALSA-2025:7967 |
| AlmaLinux:9 | osbuild-composer | 118.2-1.el9_5.alma.1 | ALSA-2025:4669 |
| AlmaLinux:9 | osbuild-composer | 132.2-1.el9_6.alma.1 | ALSA-2025:7425 |
| AlmaLinux:8 | osbuild-composer-core | 101-3.el8_10.alma.1 | ALSA-2025:7967 |
| AlmaLinux:9 | osbuild-composer-core | 132.2-1.el9_6.alma.1 | ALSA-2025:7425 |
| AlmaLinux:9 | osbuild-composer-core | 118.2-1.el9_5.alma.1 | ALSA-2025:4669 |
| AlmaLinux:8 | osbuild-composer-worker | 101-3.el8_10.alma.1 | ALSA-2025:7967 |
| AlmaLinux:9 | osbuild-composer-worker | 132.2-1.el9_6.alma.1 | ALSA-2025:7425 |
| AlmaLinux:9 | osbuild-composer-worker | 118.2-1.el9_5.alma.1 | ALSA-2025:4669 |
| Alpine:v3.22 | rclone | 1.69.3-r0 | ALPINE-CVE-2025-30204 |
| Alpine:v3.23 | rclone | 1.69.3-r0 | ALPINE-CVE-2025-30204 |
| Alpine:v3.24 | rclone | 1.69.3-r0 | ALPINE-CVE-2025-30204 |
| Debian:12 | golang-github-golang-jwt-jwt | no fix listed | DEBIAN-CVE-2025-30204 |
| Debian:13 | golang-github-golang-jwt-jwt | 5.0.0+really4.5.2-1 | DEBIAN-CVE-2025-30204 |
| Debian:14 | golang-github-golang-jwt-jwt | 5.0.0+really4.5.2-1 | DEBIAN-CVE-2025-30204 |
| Debian:13 | golang-github-golang-jwt-jwt-v5 | 5.2.2-1 | DEBIAN-CVE-2025-30204 |
| Debian:14 | golang-github-golang-jwt-jwt-v5 | 5.2.2-1 | DEBIAN-CVE-2025-30204 |
| Go | github.com/golang-jwt/jwt | no fix listed | GHSA-mh63-6h87-95cp |
| Go | github.com/golang-jwt/jwt | no fix listed | GO-2025-3553 |
| Go | github.com/golang-jwt/jwt/v4 | 4.5.2 | GHSA-mh63-6h87-95cp |
| Go | github.com/golang-jwt/jwt/v4 | 4.5.2 | GO-2025-3553 |
| Go | github.com/golang-jwt/jwt/v5 | 5.2.2 | GO-2025-3553 |
| Go | github.com/golang-jwt/jwt/v5 | 5.2.2 | GHSA-mh63-6h87-95cp |
| Rocky Linux:9 | grafana | 0:10.2.6-9.el9_5 | RLSA-2025:3344 |
| Rocky Linux:10 | opentelemetry-collector | 0:0.107.0-9.el10_0 | RLSA-2025:7479 |
| Rocky Linux:9 | opentelemetry-collector | 0:0.107.0-10.el9_5 | RLSA-2025:3411 |
| Rocky Linux:8 | osbuild-composer | 0:101-3.el8_10.rocky.0.6 | RLSA-2025:7967 |
| Ubuntu:22.04:LTS | golang-github-golang-jwt-jwt | no fix listed | UBUNTU-CVE-2025-30204 |
| Ubuntu:24.04:LTS | golang-github-golang-jwt-jwt | no fix listed | UBUNTU-CVE-2025-30204 |
| Ubuntu:24.04:LTS | golang-github-golang-jwt-jwt-v5 | no fix listed | UBUNTU-CVE-2025-30204 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| golang-jwt | jwt | >= 3.2.0, < 4.5.2>= 5.0.0-rc.1, < 5.2.2 |
Weakness: CWE-405 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp x_refsource_CONFIRM
- https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 x_refsource_MISC
- https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20250404-0002/