{"id":"GHSA-mh63-6h87-95cp","revision":null,"records":[{"revision":"6b0f90bae5e740eda76acac4176d24a1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-30204","aliases":[],"title":"jwt-go allows excessive memory allocation during header parsing","description":"golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer  followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.","state":0,"publishedAt":"2025-03-21T21:42:01.382+00:00","modifiedAt":"2025-04-10T13:03:19.897+00:00","affected":[{"ecosystem":"Vendor product","name":"jwt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"golang-jwt\",\n                    \"product\": \"jwt\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 3.2.0, < 4.5.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 5.0.0-rc.1, < 5.2.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp","https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3","https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-30204","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-30204","identifiers":["CVE-2025-30204"]},"retained":false,"historicalAffected":[]},{"revision":"b24b5869f8c34facb2fe6124a21d533f","observedAt":"2026-11-15T08:30:28.054+00:00","statement":{"source":"euvd","id":"EUVD-2025-7207","aliases":["CVE-2025-30204","GHSA-mh63-6h87-95cp"],"title":"golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods…","description":"golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer  followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp","https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3","https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7207","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 21, 2025, 9:42:01 PM","dateUpdated":"Apr 10, 2025, 1:03:19 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15054-1","title":"rclone-1.69.2-1.1 on GA media","vulnerabilityIds":["CVE-2025-22869","CVE-2025-22870","CVE-2025-30204"]},{"id":"SUSE-SU-2026:1118-1","title":"Security update for docker-stable","vulnerabilityIds":["CVE-2024-23650","CVE-2024-29018","CVE-2024-41110","CVE-2025-22868","CVE-2025-22869","CVE-2025-30204","CVE-2025-58181"]},{"id":"RHSA-2025:7753","title":"Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.15.2 security update","vulnerabilityIds":["CVE-2023-45288","CVE-2024-13484","CVE-2024-57083","CVE-2025-22868","CVE-2025-22869","CVE-2025-27144","CVE-2025-29786","CVE-2025-30204"]},{"id":"RHSA-2025:8544","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15.14 Bug Fix Update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-21538","CVE-2024-29041","CVE-2024-29180","CVE-2024-37890","CVE-2024-39249","CVE-2024-45338","CVE-2024-45590","CVE-2024-48910","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:3929","title":"Red Hat Security Advisory: ACS 4.6 enhancement and security update","vulnerabilityIds":["CVE-2024-21536","CVE-2024-57083","CVE-2025-30204"]},{"id":"SUSE-SU-2026:0659-1","title":"Security update for docker-stable","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:3798","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.25 bug fix and security update","vulnerabilityIds":["CVE-2022-49043","CVE-2024-11218","CVE-2025-29781","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:15052-1","title":"grafana-11.5.4-1.1 on GA media","vulnerabilityIds":["CVE-2024-6104","CVE-2025-2703","CVE-2025-29923","CVE-2025-30204","CVE-2025-3454"]},{"id":"RHSA-2025:4250","title":"Red Hat Security Advisory: RHSA: Submariner 0.19.4 - bug fix and enhancement update","vulnerabilityIds":["CVE-2024-53259","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2026:3718","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4","vulnerabilityIds":["CVE-2024-24790","CVE-2025-22868","CVE-2025-22869","CVE-2025-27144","CVE-2025-30204"]},{"id":"SUSE-SU-2025:02769-1","title":"Security update for amber-cli","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:4666","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.11.7 container updates","vulnerabilityIds":["CVE-2024-45336","CVE-2025-22866","CVE-2025-22868","CVE-2025-22869","CVE-2025-30204"]},{"id":"RHSA-2026:1536","title":"Red Hat Security Advisory: Red Hat Ceph Storage 9.0 Security and Enhancement update","vulnerabilityIds":["CVE-2023-25153","CVE-2024-11831","CVE-2024-31884","CVE-2025-30204","CVE-2025-52555"]},{"id":"RHSA-2025:3616","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"openSUSE-SU-2025:15419-1","title":"traefik2-2.11.28-1.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"SUSE-SU-2025:1332-1","title":"Security update for rekor","vulnerabilityIds":["CVE-2023-45288","CVE-2024-6104","CVE-2025-22868","CVE-2025-22869","CVE-2025-27144","CVE-2025-30204"]},{"id":"SUSE-SU-2025:1285-1","title":"Security update for etcd","vulnerabilityIds":["CVE-2025-30204"]},{"id":"SUSE-SU-2026:0641-1","title":"Security update for docker-stable","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:11396","title":"Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.4.5 security and bug fix update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-22868","CVE-2025-22869","CVE-2025-22871","CVE-2025-27144","CVE-2025-30204"]},{"id":"openSUSE-SU-2026:10100-1","title":"zot-registry-2.1.14-1.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:8274","title":"Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.14.4 security update","vulnerabilityIds":["CVE-2023-45288","CVE-2024-13484","CVE-2024-57083","CVE-2025-22868","CVE-2025-22869","CVE-2025-30204","CVE-2025-47933"]},{"id":"RHSA-2025:15872","title":"Red Hat Security Advisory: VolSync v0.12 security fixes and container updates","vulnerabilityIds":["CVE-2025-30204"]},{"id":"openSUSE-SU-2026:21481-1","title":"Security update for vexctl","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22868","CVE-2025-22869","CVE-2025-22870","CVE-2025-27144","CVE-2025-30204","CVE-2025-58181","CVE-2026-22772","CVE-2026-24137"]},{"id":"RHSA-2026:2172","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2024-34155","CVE-2024-34156","CVE-2024-34158","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:3344","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2025-21613","CVE-2025-30204"]},{"id":"RHSA-2025:4677","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.58 bug fix and security update","vulnerabilityIds":["CVE-2022-49043","CVE-2024-55549","CVE-2025-24855","CVE-2025-29781","CVE-2025-30204"]},{"id":"RHSA-2025:3820","title":"Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22868","CVE-2025-22869","CVE-2025-27144","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:20117-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-53547","CVE-2025-58058"]},{"id":"RHSA-2026:2164","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2024-34155","CVE-2024-34156","CVE-2024-34158","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:9646","title":"Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.3.7 security and bug fix update","vulnerabilityIds":["CVE-2024-45338","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:14048","title":"Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 10.19.0 product release","vulnerabilityIds":["CVE-2025-22869","CVE-2025-30204"]},{"id":"msrc_CVE-2025-30204","title":"jwt-go allows excessive memory allocation during header parsing","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:8059","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.7 Bug Fix Update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-29041","CVE-2024-39249","CVE-2024-45338","CVE-2024-45590","CVE-2025-27144","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:14990-1","title":"rekor-1.3.10-1.1 on GA media","vulnerabilityIds":["CVE-2023-45288","CVE-2024-6104","CVE-2025-22868","CVE-2025-22869","CVE-2025-27144","CVE-2025-30204"]},{"id":"RHSA-2025:3813","title":"Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-22868","CVE-2025-22869","CVE-2025-30204"]},{"id":"RHSA-2026:67858","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.69 bug fix and security update","vulnerabilityIds":["CVE-2025-30204","CVE-2026-33814","CVE-2026-45623","CVE-2026-46597","CVE-2026-54423"]},{"id":"RHSA-2025:4409","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.76 bug fix and security update","vulnerabilityIds":["CVE-2022-49043","CVE-2024-53150","CVE-2025-27363","CVE-2025-29781","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:14973-1","title":"etcd-3.5.21-1.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2026:0722","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.4 security update","vulnerabilityIds":["CVE-2022-21698","CVE-2023-44487","CVE-2024-24786","CVE-2025-7195","CVE-2025-9287","CVE-2025-9288","CVE-2025-30204","CVE-2025-47907","CVE-2025-58183"]},{"id":"openSUSE-SU-2025:15606-1","title":"digger-cli-0.6.127-1.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:4008","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.39 bug fix and security update","vulnerabilityIds":["CVE-2024-53150","CVE-2025-29781","CVE-2025-30204"]},{"id":"RHSA-2025:3775","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.9 bug fix and security update","vulnerabilityIds":["CVE-2022-49043","CVE-2024-11187","CVE-2025-24928","CVE-2025-27144","CVE-2025-27516","CVE-2025-29781","CVE-2025-30204"]},{"id":"RHSA-2025:23535","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.12","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:4171","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.3","vulnerabilityIds":["CVE-2025-22869","CVE-2025-30204"]},{"id":"RHSA-2026:59579","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.14 security update","vulnerabilityIds":["CVE-2024-45336","CVE-2025-22866","CVE-2025-30204","CVE-2026-10059","CVE-2026-12143","CVE-2026-19130","CVE-2026-27145","CVE-2026-39831","CVE-2026-39832","CVE-2026-42502","CVE-2026-46597","CVE-2026-47219","CVE-2026-54272","CVE-2026-66794","CVE-2026-66795","CVE-2026-66804","CVE-2026-66805","CVE-2026-66806","CVE-2026-66808","CVE-2026-69153","CVE-2026-69192","CVE-2026-73086","CVE-2026-73266","CVE-2026-73267","CVE-2026-73268","CVE-2026-73269"]},{"id":"RHSA-2025:7475","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:3607","title":"Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release","vulnerabilityIds":["CVE-2025-2786","CVE-2025-2842","CVE-2025-30204"]},{"id":"RHSA-2025:4669","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:7967","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:3928","title":"Red Hat Security Advisory: ACS 4.5 enhancement and security update","vulnerabilityIds":["CVE-2024-21536","CVE-2024-57083","CVE-2025-30204"]},{"id":"RHSA-2025:15673","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.60 bug fix and security update","vulnerabilityIds":["CVE-2024-45338","CVE-2024-45339","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:4731","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.40 bug fix and security update","vulnerabilityIds":["CVE-2022-49043","CVE-2024-55549","CVE-2025-22869","CVE-2025-24855","CVE-2025-30204"]},{"id":"RHSA-2025:8075","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:4462","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:14855","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.56 bug fix and security update","vulnerabilityIds":["CVE-2024-45339","CVE-2025-30204"]},{"id":"openSUSE-SU-2026:20366-1","title":"Security update for docker-stable","vulnerabilityIds":["CVE-2025-30204","CVE-2025-58181"]},{"id":"RHSA-2026:59558","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.10 security update","vulnerabilityIds":["CVE-2024-45336","CVE-2025-22866","CVE-2025-30204","CVE-2026-10059","CVE-2026-12143","CVE-2026-19130","CVE-2026-25681","CVE-2026-27136","CVE-2026-27145","CVE-2026-39831","CVE-2026-42502","CVE-2026-45623","CVE-2026-46595","CVE-2026-46597","CVE-2026-47219","CVE-2026-54272","CVE-2026-66794","CVE-2026-66795","CVE-2026-66804","CVE-2026-66805","CVE-2026-66808","CVE-2026-67213","CVE-2026-67214","CVE-2026-69153","CVE-2026-69192","CVE-2026-73086","CVE-2026-73266","CVE-2026-73267","CVE-2026-73268","CVE-2026-73269"]},{"id":"RHSA-2025:4204","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.27 bug fix and security update","vulnerabilityIds":["CVE-2024-24786","CVE-2025-30204"]},{"id":"RHSA-2025:23916","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2025-30204","CVE-2025-47907"]},{"id":"RHSA-2025:8479","title":"Red Hat Security Advisory: RHODF-4.16-RHEL-9 security update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-29041","CVE-2024-39249","CVE-2024-45338","CVE-2024-45590","CVE-2025-30204"]},{"id":"RHSA-2025:4019","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.10 bug fix and security update","vulnerabilityIds":["CVE-2019-25210","CVE-2024-45801","CVE-2024-53150","CVE-2025-30204"]},{"id":"openSUSE-SU-2026:20798-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-53547","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190"]},{"id":"RHSA-2025:7479","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-22868","CVE-2025-27144","CVE-2025-29786","CVE-2025-30204"]},{"id":"RHSA-2025:3618","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:8303","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.77 bug fix and security update","vulnerabilityIds":["CVE-2024-55549","CVE-2025-24855","CVE-2025-30204"]},{"id":"RHSA-2025:11749","title":"Red Hat Security Advisory: Updated 8.1 container image is now available: security and bug fix update","vulnerabilityIds":["CVE-2024-24557","CVE-2024-45338","CVE-2024-53382","CVE-2025-22865","CVE-2025-22868","CVE-2025-22871","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:15454-1","title":"trivy-0.65.0-1.1 on GA media","vulnerabilityIds":["CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-30204","CVE-2025-47291"]},{"id":"RHSA-2025:7425","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"WID-SEC-W-2025-0754","title":"Red Hat Enterprise Linux (opentelemetry-collector): Schwachstelle ermöglicht Denial of Service","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:3811","title":"Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:3930","title":"Red Hat Security Advisory: RHACS 4.7 security update","vulnerabilityIds":["CVE-2024-21536","CVE-2024-57083","CVE-2025-30204"]},{"id":"RHSA-2025:4012","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.26 bug fix and security update","vulnerabilityIds":["CVE-2024-53150","CVE-2025-22869","CVE-2025-30204"]},{"id":"RHSA-2025:8510","title":"Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.7 security and bug fix update","vulnerabilityIds":["CVE-2024-21536","CVE-2024-21538","CVE-2024-45338","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:3993","title":"Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.15.1-6 Update","vulnerabilityIds":["CVE-2025-29786","CVE-2025-30204"]},{"id":"RHSA-2025:4569","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"openSUSE-SU-2026:10302-1","title":"kubeshark-cli-53.1.0-1.1 on GA media","vulnerabilityIds":["CVE-2025-30204","CVE-2025-47914"]},{"id":"RHSA-2025:9259","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.53 bug fix and security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"openSUSE-SU-2026:10255-1","title":"docker-stable-24.0.9_ce-17.1 on GA media","vulnerabilityIds":["CVE-2025-30204","CVE-2025-58181"]},{"id":"RHSA-2025:3577","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.8 bug fix and security update","vulnerabilityIds":["CVE-2024-11218","CVE-2025-0624","CVE-2025-30204"]},{"id":"RHSA-2025:4177","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.51 bug fix and security update","vulnerabilityIds":["CVE-2024-26147","CVE-2024-53150","CVE-2025-29781","CVE-2025-30204"]},{"id":"RHSA-2025:3698","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:8556","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.42 bug fix and security update","vulnerabilityIds":["CVE-2024-6538","CVE-2024-45338","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2026:67936","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.71 bug fix and security update","vulnerabilityIds":["CVE-2025-30204","CVE-2026-33814","CVE-2026-33818","CVE-2026-42504","CVE-2026-43003","CVE-2026-44918","CVE-2026-44990","CVE-2026-45623","CVE-2026-48801","CVE-2026-56852","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-66138","CVE-2026-69153"]},{"id":"openSUSE-SU-2026:12297-1","title":"kubectl-retina-1.3.1-1.1 on GA media","vulnerabilityIds":["CVE-2024-51744","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-54410","CVE-2025-58190","CVE-2026-33186","CVE-2026-34986","CVE-2026-53941","CVE-2026-72815","CVE-2026-95838"]},{"id":"RHSA-2025:3790","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.49 bug fix and security update","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:15418-1","title":"traefik-3.5.0-1.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:3814","title":"Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-22868","CVE-2025-22869","CVE-2025-30204"]},{"id":"RHSA-2025:4511","title":"Red Hat Security Advisory: RHODF-4.18-RHEL-9 security update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-29041","CVE-2025-22868","CVE-2025-22869","CVE-2025-27144","CVE-2025-30204"]},{"id":"RHSA-2025:17671","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.81 bug fix and security update","vulnerabilityIds":["CVE-2024-45339","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:3743","title":"Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.5.1 release","vulnerabilityIds":["CVE-2025-22868","CVE-2025-27144","CVE-2025-29786","CVE-2025-30204"]},{"id":"RHSA-2025:4188","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.2","vulnerabilityIds":["CVE-2025-22869","CVE-2025-30204"]},{"id":"RHSA-2025:3411","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:3569","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.50 bug fix and security update","vulnerabilityIds":["CVE-2024-56171","CVE-2025-24928","CVE-2025-30204"]},{"id":"RHSA-2025:4473","title":"Red Hat Security Advisory: multicluster Engine for Kubernetes 2.5.9 container updates","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:7503","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:8384","title":"Red Hat Security Advisory: Red Hat multicluster global hub 1.4.1 bug fixes and container updates","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2026:2155","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2025-30204","CVE-2025-47907"]},{"id":"RHSA-2025:3808","title":"Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:11573","title":"Red Hat Security Advisory: Multicluster engine for Kubernetes 2.7.5 security updates and bug fixes","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:8691","title":"Red Hat Security Advisory: RHSA: Submariner 0.20.1 - bug fix and enhancement update","vulnerabilityIds":["CVE-2025-22871","CVE-2025-30204"]},{"id":"RHSA-2025:15332","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.80 bug fix and security update","vulnerabilityIds":["CVE-2024-45338","CVE-2024-45339","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:14956-1","title":"headscale-0.25.1-2.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:9388","title":"Red Hat Security Advisory: Red Hat Multicluster GlobalHub 1.2.3 bug fixes and container updates","vulnerabilityIds":["CVE-2025-30204"]},{"id":"SUSE-SU-2026:0972-1","title":"Security update for docker-stable","vulnerabilityIds":["CVE-2024-23650","CVE-2024-29018","CVE-2024-41110","CVE-2025-22868","CVE-2025-22869","CVE-2025-30204","CVE-2025-58181"]},{"id":"RHSA-2025:9167","title":"Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.6.0 release","vulnerabilityIds":["CVE-2025-22868","CVE-2025-27144","CVE-2025-29786","CVE-2025-30204"]},{"id":"openSUSE-SU-2025-20117-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-53547","CVE-2025-58058"]},{"id":"RHSA-2025:23057","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.3.2","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:7702","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.52 bug fix and security update","vulnerabilityIds":["CVE-2022-49043","CVE-2024-55549","CVE-2025-0624","CVE-2025-22869","CVE-2025-24855","CVE-2025-30204"]},{"id":"RHSA-2025:8552","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.33 bug fix and security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:9541","title":"Red Hat Security Advisory: Submariner 0.17.6 bug fixes and container updates","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:8542","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.13.3 fixes and container updates","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:3740","title":"Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release","vulnerabilityIds":["CVE-2025-2786","CVE-2025-2842","CVE-2025-22868","CVE-2025-29786","CVE-2025-30204"]},{"id":"RHSA-2025:23534","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.2.7","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"openSUSE-SU-2026:10099-1","title":"zli-2.1.14-1.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:11669","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.54 bug fix and security update","vulnerabilityIds":["CVE-2024-6104","CVE-2024-45338","CVE-2025-22868","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:14989-1","title":"flannel-0.26.6-1.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"openSUSE-SU-2025:14954-1","title":"gotosocial-0.18.3-2.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:3905","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.7","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:4502","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.10.8 container updates","vulnerabilityIds":["CVE-2025-22869","CVE-2025-30204"]},{"id":"RHSA-2025:11681","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.45 bug fix and security update","vulnerabilityIds":["CVE-2024-45339","CVE-2024-51744","CVE-2025-6032","CVE-2025-30204","CVE-2025-48060"]},{"id":"RHSA-2025:4211","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.11 bug fix and security update","vulnerabilityIds":["CVE-2024-8676","CVE-2025-27144","CVE-2025-30204"]},{"id":"RHSA-2025:18241","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.61 bug fix and security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:8244","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.21.0 release","vulnerabilityIds":["CVE-2024-12905","CVE-2024-45337","CVE-2024-45410","CVE-2025-22869","CVE-2025-30204"]},{"id":"RHSA-2025:18242","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.61 security and extras update","vulnerabilityIds":["CVE-2025-30204","CVE-2025-53547"]},{"id":"openSUSE-SU-2025:15037-1","title":"amber-cli-1.13.1+git20250329.c2e3bb8-1.1 on GA media","vulnerabilityIds":["CVE-2025-30204"]},{"id":"openSUSE-SU-2026:10230-1","title":"vexctl-0.4.1+git78.f951e3a-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22868","CVE-2025-22869","CVE-2025-22870","CVE-2025-27144","CVE-2025-30204","CVE-2025-58181","CVE-2026-22772","CVE-2026-24137"]},{"id":"RHSA-2025:3906","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.9.13","vulnerabilityIds":["CVE-2025-25186","CVE-2025-27144","CVE-2025-27610","CVE-2025-30204"]},{"id":"SUSE-SU-2026:0592-1","title":"Security update for vexctl","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22868","CVE-2025-22869","CVE-2025-22870","CVE-2025-27144","CVE-2025-30204","CVE-2025-58181","CVE-2026-22772","CVE-2026-24137"]},{"id":"WID-SEC-W-2025-0633","title":"Gitea: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-29923","CVE-2025-30204"]},{"id":"RHSA-2025:3503","title":"Red Hat Security Advisory: Red Hat build of Cryostat security update","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2025:4810","title":"Red Hat Security Advisory: RHSA: Submariner 0.18.5 - bug and security update","vulnerabilityIds":["CVE-2024-45336","CVE-2024-53259","CVE-2025-22866","CVE-2025-22868","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:15307-1","title":"velociraptor-0.7.0.4.git163.87ee3570-1.1 on GA media","vulnerabilityIds":["CVE-2025-27144","CVE-2025-27152","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:14937-1","title":"govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media","vulnerabilityIds":["CVE-2024-25132","CVE-2024-53348","CVE-2024-53351","CVE-2024-7598","CVE-2024-7631","CVE-2024-9042","CVE-2024-9900","CVE-2025-1097","CVE-2025-1098","CVE-2025-1472","CVE-2025-1767","CVE-2025-1974","CVE-2025-24513","CVE-2025-24514","CVE-2025-24920","CVE-2025-25068","CVE-2025-25274","CVE-2025-27612","CVE-2025-27715","CVE-2025-27933","CVE-2025-29778","CVE-2025-29914","CVE-2025-29922","CVE-2025-29923","CVE-2025-30077","CVE-2025-30153","CVE-2025-30162","CVE-2025-30163","CVE-2025-30179","CVE-2025-30204"]},{"id":"RHSA-2025:3907","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.1.5","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:4422","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.50 bug fix and security update","vulnerabilityIds":["CVE-2022-49043","CVE-2024-53150","CVE-2024-55549","CVE-2025-0624","CVE-2025-24855","CVE-2025-29781","CVE-2025-30204"]},{"id":"RHSA-2025:8267","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:7404","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:16595","title":"Red Hat Security Advisory: VolSync v0.13 security fixes and container updates","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:8560","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.17 bug fix and security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:3565","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.24 bug fix and security update","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHEA-2025:4438","title":"Red Hat Enhancement Advisory: Red Hat OpenShift Service on AWS 1.0 enhancements","vulnerabilityIds":["CVE-2024-45337","CVE-2025-30204"]},{"id":"openSUSE-SU-2026:20620-1","title":"Security update for rclone","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2024-52522","CVE-2025-22869","CVE-2025-22870","CVE-2025-30204","CVE-2025-58181","CVE-2025-68121","CVE-2026-1229","CVE-2026-27141","CVE-2026-33186","CVE-2026-41176","CVE-2026-41179"]},{"id":"RHSA-2025:8392","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.9.9 bug fixes and container updates","vulnerabilityIds":["CVE-2025-30204"]},{"id":"RHSA-2025:7407","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-22868","CVE-2025-27144","CVE-2025-29786","CVE-2025-30204"]},{"id":"RHSA-2025:8390","title":"Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.4.9 security updates and bug fixes","vulnerabilityIds":["CVE-2025-22868","CVE-2025-30204"]},{"id":"openSUSE-SU-2026:12300-1","title":"kumactl-3.0.0-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-22869","CVE-2025-22872","CVE-2025-30204","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181","CVE-2025-58190","CVE-2026-26958","CVE-2026-33186","CVE-2026-41178"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-7207","identifiers":["EUVD-2025-7207","CVE-2025-30204","GHSA-mh63-6h87-95cp"]},"retained":false,"historicalAffected":[]},{"revision":"90d1e916e90f40c2b86eca2107624319","observedAt":"2026-10-25T02:24:42.386+00:00","statement":{"source":"nvd","id":"CVE-2025-30204","aliases":[],"title":"golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods…","description":"golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer  followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.","state":0,"publishedAt":"2025-03-21T22:15:26.42+00:00","modifiedAt":"2026-06-17T09:08:21.1+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3","https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb","https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp","https://security.netapp.com/advisory/ntap-20250404-0002/"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30204","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-405"],"productCriteria":[],"sourceDates":{"published":"2025-03-21T22:15:26.420","lastModified":"2026-06-17T09:08:21.100"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-30204","identifiers":["CVE-2025-30204"]},"retained":false,"historicalAffected":[]},{"revision":"329b39022a87438398363318e6c21304","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-mh63-6h87-95cp","aliases":["CVE-2025-30204","GO-2025-3553"],"title":"jwt-go allows excessive memory allocation during header parsing","description":"### Summary\n\nFunction [`parse.ParseUnverified`](https://github.com/golang-jwt/jwt/blob/c035977d9e11c351f4c05dfeae193923cbab49ee/parser.go#L138-L139) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) its argument (which is untrusted data) on periods.\n\nAs a result, in the face of a malicious request whose _Authorization_ header consists of `Bearer ` followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)\n\n### Details\n\nSee [`parse.ParseUnverified`](https://github.com/golang-jwt/jwt/blob/c035977d9e11c351f4c05dfeae193923cbab49ee/parser.go#L138-L139) \n\n### Impact\n\nExcessive memory allocation","state":0,"publishedAt":"2025-03-21T22:04:00+00:00","modifiedAt":"2026-09-10T03:50:56.8016465+00:00","affected":[{"ecosystem":"Go","name":"github.com/golang-jwt/jwt/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.0.0-rc.1"},{"kind":"fixed","version":"5.2.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/golang-jwt/jwt/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.5.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/golang-jwt/jwt","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.2.0"},{"kind":"last_affected","version":"3.2.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp","https://nvd.nist.gov/vuln/detail/CVE-2025-30204","https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3","https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb","https://github.com/golang-jwt/jwt","https://security.netapp.com/advisory/ntap-20250404-0002"],"sourceUrl":"https://github.com/advisories/GHSA-mh63-6h87-95cp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mh63-6h87-95cp","identifiers":["GHSA-mh63-6h87-95cp","CVE-2025-30204","GO-2025-3553"]},"retained":false,"historicalAffected":[]},{"revision":"06ec52360f004ac8bda2134074c29bba","observedAt":"2026-11-14T13:57:00.683+00:00","statement":{"source":"osv","id":"GO-2025-3553","aliases":["CVE-2025-30204","GHSA-mh63-6h87-95cp"],"title":"Excessive memory allocation during header parsing in github.com/golang-jwt/jwt","description":"Excessive memory allocation during header parsing in github.com/golang-jwt/jwt","state":0,"publishedAt":"2025-03-26T17:24:24+00:00","modifiedAt":"2026-11-14T13:12:14.6836475+00:00","affected":[{"ecosystem":"Go","name":"github.com/golang-jwt/jwt","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/golang-jwt/jwt/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.5.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/golang-jwt/jwt/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.0.0-rc.1"},{"kind":"fixed","version":"5.2.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp","https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-3553","license":"OSV · upstream source license applies","key":"osv:GO-2025-3553","identifiers":["GO-2025-3553","CVE-2025-30204","GHSA-mh63-6h87-95cp"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T11:05:17.2943378+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T11:05:17.2943378+00:00","lastSuccessAt":"2026-11-15T11:05:17.4673918+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.4673928+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-f90179050d1e68c26defb06294e68ca9aad67fa6285a72a309f2510089445b08","complete":true,"records":425787,"lastAttemptAt":"2026-11-15T11:01:58.8542146+00:00","lastSuccessAt":"2026-11-15T11:01:58.8389797+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:01:58.8542146+00:00","snapshotPublishedAt":"2026-11-15T10:28:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f981543109394c8f9b3df5737aa835e7","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T11:15:00.6236179+00:00","lastSuccessAt":"2026-11-15T11:15:00.619+00:00","error":"257 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T11:15:00.619+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13558,"expectedIdentifiers":13874,"failedIdentifiers":257},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T11:05:17.2943378+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T11:05:17.2943378+00:00","lastSuccessAt":"2026-11-15T11:05:17.4693563+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.4693566+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T11:05:18.0594066+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T11:05:12.198625+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:12.198625+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T11:01:59.0034935+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:01:59.0034935+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T11:05:17.2566792+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.2566792+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T11:05:12.0533004+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:12.0533004+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}