golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composerUpgrade osbuild-composer-coreUpgrade grafana-selinuxUpgrade grafanaUpgrade osbuild-composer-worker | Apr 1, 2025 | Mar 21, 2025 |
| Alpine Linux | — | Upgrade rclone | Aug 8, 2025 | Mar 21, 2025 |
| Amazon Linux Ami 2 | — | Upgrade dockerUpgrade docker-debuginfoUpgrade runfinch-finchUpgrade amazon-cloudwatch-agent | Apr 30, 2025 | Mar 21, 2025 |
| Amazon_linux_2023 | — | Upgrade amazon-cloudwatch-agentUpgrade dockerUpgrade runfinch-finchUpgrade docker-debuginfoUpgrade docker-debugsource | Apr 30, 2025 | Mar 21, 2025 |
| Debian | — | Upgrade golang-github-golang-jwt-jwt-v5Upgrade golang-github-golang-jwt-jwt | May 15, 2025 | Mar 21, 2025 |
| Freebsd | — | Upgrade gitea | Apr 2, 2025 | Mar 31, 2025 |
| Oracle_linux | — | Upgrade grafana-selinuxUpgrade grafanaUpgrade osbuild-composerUpgrade osbuild-composer-coreUpgrade osbuild-composer-worker | Mar 28, 2025 | Mar 21, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Mar 21, 2025 |
| Redhat_linux | — | Upgrade osbuild-composer-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade grafana-selinuxUpgrade grafana-debuginfoUpgrade osbuild-composerUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade opentelemetry-collectorUpgrade osbuild-composer-coreUpgrade osbuild-composer-dnf-jsonUpgrade grafanaUpgrade osbuild-composer-workerUpgrade osbuild-composer-debuginfoUpgrade grafana-debugsource | Mar 28, 2025 | Mar 21, 2025 |
| Rocky_linux | — | Upgrade osbuild-composer-coreUpgrade grafanaUpgrade grafana-debugsourceUpgrade osbuild-composer-workerUpgrade grafana-debuginfoUpgrade grafana-selinuxUpgrade osbuild-composerUpgrade opentelemetry-collector | Jul 31, 2025 | Jul 29, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.13Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.2.5Upgrade Splunk Enterprise to version 10.4.1Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 10.0.8 | Mar 20, 2026 | Mar 21, 2025 |
| Suse | — | Upgrade etcdutlUpgrade amber-cliUpgrade rcloneUpgrade rclone-bash-completionUpgrade govulncheck-vulndbUpgrade etcdUpgrade etcdctlUpgrade rclone-zsh-completionUpgrade rekor | Dec 5, 2025 | Mar 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub