golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composer-coreUpgrade osbuild-composerUpgrade grafana-selinuxUpgrade grafanaUpgrade osbuild-composer-worker | Apr 1, 2025 | Mar 21, 2025 |
| Alpine Linux | — | Upgrade rclone | Aug 8, 2025 | Mar 21, 2025 |
| Amazon Linux Ami 2 | — | Upgrade runfinch-finchUpgrade dockerUpgrade docker-debuginfoUpgrade amazon-cloudwatch-agent | Apr 30, 2025 | Mar 21, 2025 |
| Amazon_linux_2023 | — | Upgrade docker-debugsourceUpgrade docker-debuginfoUpgrade runfinch-finchUpgrade amazon-cloudwatch-agentUpgrade docker | Apr 30, 2025 | Mar 21, 2025 |
| Debian | — | Upgrade golang-github-golang-jwt-jwtUpgrade golang-github-golang-jwt-jwt-v5 | May 15, 2025 | Mar 21, 2025 |
| Freebsd | — | Upgrade gitea | Apr 2, 2025 | Mar 31, 2025 |
| Oracle_linux | — | Upgrade grafana-selinuxUpgrade osbuild-composerUpgrade osbuild-composer-coreUpgrade osbuild-composer-workerUpgrade grafana | Mar 28, 2025 | Mar 21, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Mar 21, 2025 |
| Redhat_linux | — | Upgrade osbuild-composer-workerUpgrade grafanaUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-coreUpgrade opentelemetry-collectorUpgrade grafana-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composerUpgrade osbuild-composer-debugsourceUpgrade grafana-debuginfoUpgrade grafana-selinuxUpgrade osbuild-composer-tests-debuginfo | Mar 28, 2025 | Mar 21, 2025 |
| Rocky_linux | — | Upgrade osbuild-composerUpgrade grafana-debuginfoUpgrade grafana-selinuxUpgrade opentelemetry-collectorUpgrade grafanaUpgrade osbuild-composer-coreUpgrade grafana-debugsourceUpgrade osbuild-composer-worker | Jul 31, 2025 | Jul 29, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.4.13Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 10.2.5Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.4.1Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 10.0.8 | Mar 20, 2026 | Mar 21, 2025 |
| Suse | — | Upgrade rcloneUpgrade etcdutlUpgrade amber-cliUpgrade rclone-zsh-completionUpgrade etcdctlUpgrade govulncheck-vulndbUpgrade rekorUpgrade rclone-bash-completionUpgrade etcd | Dec 5, 2025 | Mar 29, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub