CVE-2025-30204 json
jwt-go allows excessive memory allocation during header parsing
published 2025-03-21 19 mo ago modified 2026-09-10 1 mo ago also GHSA-mh63-6h87-95cp , GO-2025-3553 , EUVD-2025-7207
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
Patch / fix
- go github.com/golang-jwt/jwt/v5 5.2.2
- go github.com/golang-jwt/jwt/v4 4.5.2
- golang-github-golang-jwt-jwt Debian 14, Debian 13 5.0.0+really4.5.2-1
- golang-github-golang-jwt-jwt-v5 Debian 14, Debian 13 5.2.2-1
debian advisories DEBIAN-CVE-2025-30204
- rosa openshift service on aws 1 1.2.53-5be4e19.el8
- rosa-redistributable openshift service on aws 1 1.2.53-5be4e19.el8
- ceph ceph storage 9.0 2:20.1.0-144.el10cp
- ceph ceph storage 9.0 2:20.1.0-144.el9cp
- cephadm ceph storage 9.0 2:20.1.0-144.el10cp
- cephadm ceph storage 9.0 2:20.1.0-144.el9cp
- librbd1 ceph storage 9.0 2:20.1.0-144.el10cp
- librbd1 ceph storage 9.0 2:20.1.0-144.el9cp
red hat advisories RHEA-2025:4438RHSA-2026:1536RHSA-2025:8267RHSA-2025:8075RHSA-2025:7967RHSA-2025:7503
- docker-stable SLE Module for Containers 15 SP7, openSUSE Leap 15.6 24.0.9_ce-150000.1.39.1
- docker-stable SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +9 more 24.0.9_ce-150000.1.36.1
- vexctl openSUSE Leap 15.6 0.4.1+git78.f951e3a-150000.1.11.1
- amber-cli SLE Module for Server Applications 15 SP7, SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 1.13.1+git20250329.c2e3bb8-150600.3.3.1
- rekor SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +9 more 1.3.10-150400.4.25.1
- etcd openSUSE Leap 15.6 3.5.21-150000.7.12.1
- docker-stable SLES LTSS Extended Security 12 SP5 24.0.9_ce-1.32.1
- docker-stable SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 24.0.9_ce-1.29.1
suse advisories SUSE-SU-2026:1118-1SUSE-SU-2026:0972-1SUSE-SU-2026:0659-1SUSE-SU-2026:0641-1SUSE-SU-2026:0592-1SUSE-SU-2025:02769-1
- kubectl-retina openSUSE Tumbleweed 1.3.1-1.1
- kumactl openSUSE Tumbleweed 3.0.0-1.1
- vexctl openSUSE Leap 16.0 0.4.4+git20.5d61136-160000.1.1
- docker-stable openSUSE Leap 16.0 24.0.9_ce-160000.4.1
- kubeshark-cli openSUSE Tumbleweed 53.1.0-1.1
- docker-stable openSUSE Tumbleweed 24.0.9_ce-17.1
- vexctl openSUSE Tumbleweed 0.4.1+git78.f951e3a-1.1
- zli openSUSE Tumbleweed 2.1.14-1.1
opensuse advisories openSUSE-SU-2026:12297-1openSUSE-SU-2026:12300-1openSUSE-SU-2026:21481-1openSUSE-SU-2026:20366-1openSUSE-SU-2026:10302-1openSUSE-SU-2026:10255-1
- osbuild-composer AlmaLinux 8 101-3.el8_10.alma.1
- osbuild-composer-core AlmaLinux 8 101-3.el8_10.alma.1
- osbuild-composer-worker AlmaLinux 8 101-3.el8_10.alma.1
- grafana AlmaLinux 9 10.2.6-11.el9_6
- grafana-selinux AlmaLinux 9 10.2.6-11.el9_6
- osbuild-composer AlmaLinux 9 132.2-1.el9_6.alma.1
- osbuild-composer-core AlmaLinux 9 132.2-1.el9_6.alma.1
- osbuild-composer-worker AlmaLinux 9 132.2-1.el9_6.alma.1
almalinux advisories ALSA-2025:7967ALSA-2025:7404ALSA-2025:7425ALSA-2025:7475ALSA-2025:4669ALSA-2025:3344
- osbuild-composer Rocky Linux 8 101-3.el8_10.rocky.0.6
- opentelemetry-collector Rocky Linux 10 0.107.0-9.el10_0
- grafana Rocky Linux 9 10.2.6-9.el9_5
- opentelemetry-collector Rocky Linux 9 0.107.0-10.el9_5
rocky linux advisories RLSA-2025:7967RLSA-2025:7479RLSA-2025:3344RLSA-2025:3411
- rclone Alpine 3.24, Alpine 3.23, Alpine 3.22 1.69.3-r0
alpine advisories ALPINE-CVE-2025-30204
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- flannel Azure Linux 3.0 0.24.2-12
- prometheus Azure Linux 3.0 2.45.4-10
- cert-manager Azure Linux 3.0 1.12.15-3
- etcd CBL-Mariner 2.0, Azure Linux 3.0 3.5.21-1
- azcopy Azure Linux 3.0 10.25.1-3
- blobfuse2 Azure Linux 3.0 2.3.2-2
- coredns Azure Linux 3.0 1.11.4-5
- moby-engine Azure Linux 3.0 25.0.3-12
azure linux advisories AZL-59159AZL-59162AZL-59165AZL-59168AZL-59169AZL-59172
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-30204 updated cvss 7.5
golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
-
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8, rhai-tech-preview/assisted-installer-reporter-rhel8 Red Hat cert-manager Operator for Red Hat OpenShift jetstack-cert-manager-rhel9, openshift4/jetstack-cert-manager-acmesolveraffected: workaround, no fix available “Red Hat Product Security does not have a recommended mitigation at this time.”
-
Red Hat Cryostat 3 cryostat-tech-preview/cryostat-storage-rhel8affected: workaround, no fix planned “Red Hat Product Security does not have a recommended mitigation at this time.”
-
Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8 Red Hat Migration Toolkit for Applications 7 mta/mta-cli-rhel9, mta/mta-hub-rhel9, mta/mta-analyzer-addon-rhel9, mta/mta-discovery-addon-rhel9, mta/mta-java-external-provider-rhel9, mta/mta-generic-external-provider-rhel9 Red Hat OpenShift Pipelines openshift-pipelines-clientaffected: workaround, no fix available “Red Hat Product Security does not have a recommended mitigation at this time.”
-
Red Hat OpenShift Serverless openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/func-utils-rhel8, openshift-serverless-1/serving-queue-rhel8, openshift-serverless-1/serving-webhook-rhel8, openshift-serverless-1/serving-activator-rhel8, openshift-serverless-1/serving-autoscaler-rhel8, +5 moreaffected: workaround, no fix available, no fix planned “Red Hat Product Security does not have a recommended mitigation at this time.”
-
Red Hat OpenShift Service Mesh 2 openshift-service-mesh/pilot-rhel8, openshift-service-mesh/proxyv2-rhel8, openshift-service-mesh/istio-cni-rhel8 Red Hat Ceph Storage 5 openshift4/grafanaaffected: workaround, no fix planned “Red Hat Product Security does not have a recommended mitigation at this time.”
-
Red Hat Connectivity Link 1 openshift4/dns-operator Red Hat OpenShift AI (RHOAI) rhoai/odh-data-science-pipelines-argo-argoexec-rhel8, rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8 Red Hat OpenShift Cluster Manager CLI ocm-cli-clients/ocm-cli-rhel9affected: workaround, no fix available “Red Hat Product Security does not have a recommended mitigation at this time.”
-
Red Hat OpenShift Container Platform 4 microshift, microshift-olm, microshift-sriov, microshift-multus, microshift-selinux, microshift-greenboot, +17 moreaffected: workaround, no fix available, no fix planned “Red Hat Product Security does not have a recommended mitigation at this time.”
-
Red Hat Openshift Data Foundation 4 odf4/mcg-cli-rhel9 Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8 Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-podvm-builder-rhel9, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9 Red Hat OpenShift Update Service openshift-update-service/openshift-update-service-rhel8-operatoraffected: workaround, no fix available “Red Hat Product Security does not have a recommended mitigation at this time.”
show 20 moreshow fewer
-
Red Hat OpenShift Virtualization 4 container-native-virtualization/kubesecondarydns-rhel9, container-native-virtualization/hyperconverged-cluster-webhook-rhel9, container-native-virtualization/hyperconverged-cluster-operator-rhel9affected: workaround, no fix available, no fix planned “Red Hat Product Security does not have a recommended mitigation at this time.”
-
Red Hat Quay 3 quay/quay-bridge-operator-rhel8affected: workaround, no fix available “Red Hat Product Security does not have a recommended mitigation at this time.”
-
Red Hat Builds for Red Hat OpenShift 1.2.2 openshift-builds 1.2.2-1744783337, openshift-builds 1.2.2-1744783340, openshift-builds 1.2.2-1744783467, openshift-builds 1.2.2-1744783714, openshift-builds 1.2.2-1744785603, openshift-builds 1.2.2-1744792147fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:4188
-
Red Hat Builds for Red Hat OpenShift 1.3.2 openshift-builds 1.3.2-1744785084, openshift-builds 1.3.2-1744785360, openshift-builds 1.3.2-1744786270, openshift-builds 1.3.2-1744787137, openshift-builds 1.3.2-1744792586, openshift-builds 1.3.2-1744793386fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:4171
-
Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.0.0-10, cryostat/cryostat-db-rhel9 4.0.0-10, cryostat/jfr-datasource-rhel9 4.0.0-10, cryostat/cryostat-reports-rhel9 4.0.0-10, cryostat/cryostat-storage-rhel9 4.0.0-10, cryostat/cryostat-operator-bundle 4.0.0-9, +5 morefixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:3503
-
Red Hat Custom Metric Autoscaler operator for Red Hat Openshift 2.15 custom-metrics-autoscaler 2.15.1-1744845044, custom-metrics-autoscaler 2.15.1-1744845058, custom-metrics-autoscaler 2.15.1-1744845343fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:3993
-
Red Hat Logging for Red Hat OpenShift 6.3 openshift-loggingfixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:23057
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-loggingfixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:23535
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.2 openshift-loggingfixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:23534
-
Red Hat multicluster engine for Kubernetes 2.4 for RHEL 8 multicluster-engine/hive-rhel8 v2.4.9-7, multicluster-engine/work-rhel8 v2.4.9-3, multicluster-engine/discovery-rhel8 v2.4.9-3, multicluster-engine/placement-rhel8 v2.4.9-5, multicluster-engine/cluster-api-rhel8 v2.4.9-3, multicluster-engine/console-mce-rhel8 v2.4.9-5, +30 morefixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:8390
-
Red Hat multicluster engine for Kubernetes 2.5 for RHEL 8 multicluster-engine/hive-rhel8 v2.5.9-9, multicluster-engine/agent-service-rhel8 v2.5.9-8, multicluster-engine/assisted-installer-rhel8 v2.5.9-8, multicluster-engine/assisted-image-service-rhel8 v2.5.9-7, multicluster-engine/assisted-installer-agent-rhel8 v2.5.9-8, multicluster-engine/assisted-installer-reporter-rhel8 v2.5.9-8 Red Hat multicluster engine for Kubernetes 2.5 for RHEL 9 multicluster-engine/work-rhel9 v2.5.9-12, multicluster-engine/discovery-rhel9 v2.5.9-10, multicluster-engine/placement-rhel9 v2.5.9-12, multicluster-engine/cluster-api-rhel9 v2.5.9-6, multicluster-engine/console-mce-rhel9 v2.5.9-11, multicluster-engine/must-gather-rhel9 v2.5.9-13, +26 morefixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:4473
-
Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hypershift-cli-rhel9 1787264175fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2026:59579
-
Red Hat multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-installer-rhel8 v2.6.8-8, multicluster-engine/assisted-image-service-rhel8 v2.6.8-8, multicluster-engine/assisted-installer-agent-rhel8 v2.6.8-9, multicluster-engine/assisted-installer-controller-rhel8 v2.6.8-8 Red Hat multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/cluster-api-rhel9 v2.6.8-9fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:13900
-
Red Hat multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8 v2.7.5-15 Red Hat multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/hive-rhel9 v2.7.5-13, multicluster-engine/work-rhel9 v2.7.5-14, multicluster-engine/discovery-rhel9 v2.7.5-16, multicluster-engine/placement-rhel9 v2.7.5-14, multicluster-engine/cluster-api-rhel9 v2.7.5-10, multicluster-engine/console-mce-rhel9 v2.7.5-16, +28 morefixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:11573
-
Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1765908967, multicluster-engine/hypershift-cli-rhel9 1787259077, multicluster-engine/hypershift-addon-rhel9-operator 1787259113fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2026:59558
-
Red Hat multicluster-globalhub 1.2 for RHEL 9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 v1.2.3-2, multicluster-globalhub/multicluster-globalhub-grafana-rhel9 v1.2.3-2, multicluster-globalhub/multicluster-globalhub-manager-rhel9 v1.2.3-2, multicluster-globalhub/multicluster-globalhub-rhel9-operator v1.2.3-2, multicluster-globalhub/multicluster-globalhub-operator-bundle v1.2.3-3, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 v1.2.3-2fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:9388
-
Red Hat multicluster-globalhub 1.4 for RHEL 9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 v1.4.1-5, multicluster-globalhub/multicluster-globalhub-grafana-rhel9 v1.4.1-6, multicluster-globalhub/multicluster-globalhub-manager-rhel9 v1.4.1-4, multicluster-globalhub/multicluster-globalhub-rhel9-operator v1.4.1-4, multicluster-globalhub/multicluster-globalhub-operator-bundle v1.4.1-12, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 v1.4.1-4, +1 morefixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:8384
-
Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1.3.7-19, oadp/oadp-rhel9-operator 1.3.7-18, oadp/oadp-velero-plugin-rhel9 1.3.7-18, oadp/oadp-velero-plugin-for-csi-rhel9 1.3.7-17, oadp/oadp-velero-plugin-for-microsoft-azure-rhel9 1.3.7-19fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:9646
-
Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-velero-rhel9 1.4.5-20, oadp/oadp-rhel9-operator 1.4.5-20, oadp/oadp-mustgather-rhel9 1.4.5-34, oadp/oadp-velero-plugin-rhel9 1.4.5-18, oadp/oadp-velero-restic-restore-helper-rhel9 1.4.5-20, oadp/oadp-velero-plugin-for-microsoft-azure-rhel9 1.4.5-18fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:11396
-
Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/thanos-rhel8 v2.9.9-3, rhacm2/console-rhel8 v2.9.9-3, rhacm2/memcached-rhel8 v2.9.9-2, rhacm2/prometheus-rhel8 v2.9.9-3, rhacm2/acm-grafana-rhel8 v2.9.9-3, rhacm2/acm-operator-bundle v2.9.9-2, +38 morefixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:8392
46 more fixed, 45 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/golang-jwt/jwt/v5 | >=5.0.0-rc.1, <5.2.2 |
5.2.2 |
| go | github.com/golang-jwt/jwt/v4 | <4.5.2 |
4.5.2 |
| go | github.com/golang-jwt/jwt | >=3.2.0, <=3.2.2 all versions |
no fix listed |
Affected products
- golang-jwt jwt
Classification
- Weakness
-
- CWE-405 Asymmetric Resource Consumption (Amplification)
References
-
github.com
/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3
web, patch
-
github.com
/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb
web
-
github.com
/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp
web, advisory
- security.netapp.com /advisory/ntap-20250404-0002/
-
nvd.nist.gov
/vuln/detail/CVE-2025-30204
advisory
-
github.com
/golang-jwt/jwt
package
-
security.netapp.com
/advisory/ntap-20250404-0002
web
Sources
- CVE List CVE-2025-30204
- GitHub Advisory GHSA-mh63-6h87-95cp
- NVD CVE-2025-30204
- OSV GO-2025-3553
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.