CVE-2025-30204
Description
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
How to fix
- github.com/golang-jwt/jwt/v55.2.2 or later
- github.com/golang-jwt/jwt/v44.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/golang-jwt/jwt/v5Go | 5.0.0-rc.1 ≤ v < 5.2.2 | 5.2.2 |
| github.com/golang-jwt/jwt/v4Go | v < 4.5.2 | 4.5.2 |
| github.com/golang-jwt/jwtGo | 3.2.0 ≤ v ≤ 3.2.2, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.