CVE-2025-30204
jwt-go allows excessive memory allocation during header parsing
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
golang-jwt is a Go implementation of JSON Web Tokens. Prior to 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.
Red Hat OpenShift Container Platform release 4.17.24 is now available with updates to packages and images that fix several bugs and add enhancements.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2025-02-28 CVE Published
- 2025-03-18 CVE Reserved
- 2025-04-10 CVE Updated
- 2025-07-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-405: Asymmetric Resource Consumption (Amplification)
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 | X_refsource_misc | |
| https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp | X_refsource_confirm | |
| https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2025-30204 | 2025-06-25 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2354195 | 2025-06-25 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Golang-jwt Search vendor "Golang-jwt" | Jwt Search vendor "Golang-jwt" for product "Jwt" | >= 3.2.0 < 4.5.2 Search vendor "Golang-jwt" for product "Jwt" and version " >= 3.2.0 < 4.5.2" | en |
Affected
| ||||||
| Golang-jwt Search vendor "Golang-jwt" | Jwt Search vendor "Golang-jwt" for product "Jwt" | >= 5.0.0 < 5.2.2 Search vendor "Golang-jwt" for product "Jwt" and version " >= 5.0.0 < 5.2.2" | en |
Affected
| ||||||