golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composer-coreUpgrade grafana-selinuxUpgrade osbuild-composerUpgrade grafanaUpgrade osbuild-composer-worker | Apr 1, 2025 | Mar 21, 2025 |
| Alpine Linux | — | Upgrade rclone | Aug 8, 2025 | Mar 21, 2025 |
| Amazon Linux Ami 2 | — | Upgrade amazon-cloudwatch-agentUpgrade docker-debuginfoUpgrade dockerUpgrade runfinch-finch | Apr 30, 2025 | Mar 21, 2025 |
| Amazon_linux_2023 | — | Upgrade docker-debugsourceUpgrade docker-debuginfoUpgrade runfinch-finchUpgrade dockerUpgrade amazon-cloudwatch-agent | Apr 30, 2025 | Mar 21, 2025 |
| Debian | — | Upgrade golang-github-golang-jwt-jwt-v5Upgrade golang-github-golang-jwt-jwt | May 15, 2025 | Mar 21, 2025 |
| Freebsd | — | Upgrade gitea | Apr 2, 2025 | Mar 31, 2025 |
| Oracle_linux | — | Upgrade grafanaUpgrade osbuild-composer-workerUpgrade osbuild-composerUpgrade osbuild-composer-coreUpgrade grafana-selinux | Mar 28, 2025 | Mar 21, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Mar 21, 2025 |
| Redhat_linux | — | Upgrade grafana-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-composer-debugsourceUpgrade grafana-selinuxUpgrade osbuild-composerUpgrade osbuild-composer-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade grafana-debugsourceUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-workerUpgrade opentelemetry-collectorUpgrade grafanaUpgrade osbuild-composer-core | Mar 28, 2025 | Mar 21, 2025 |
| Rocky_linux | — | Upgrade grafana-debugsourceUpgrade osbuild-composer-workerUpgrade osbuild-composer-coreUpgrade grafanaUpgrade grafana-debuginfoUpgrade grafana-selinuxUpgrade osbuild-composerUpgrade opentelemetry-collector | Jul 31, 2025 | Jul 29, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.13Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 10.0.8Upgrade Splunk Enterprise to version 10.4.1Upgrade Splunk Enterprise to version 10.2.5 | Mar 20, 2026 | Mar 21, 2025 |
| Suse | — | Upgrade amber-cliUpgrade etcdutlUpgrade rcloneUpgrade etcdctlUpgrade rekorUpgrade govulncheck-vulndbUpgrade rclone-bash-completionUpgrade etcdUpgrade rclone-zsh-completion | Dec 5, 2025 | Mar 29, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub