CVE-2025-30204highCWE-405

CVE-2025-30204: falha de alta gravidade em golang-jwt jwt

jwt-go allows excessive memory allocation during header parsing

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar jwt+ Monitorar rclone

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
golang-jwt · jwt
CVEs relacionadas — golang-jwt jwt

No mesmo produto, das mais perigosas para as menos.

CVE-2024-51744LOWBad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwtEPSS 0.6%