The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composer-workerUpgrade grafanaUpgrade osbuild-composerUpgrade grafana-selinuxUpgrade osbuild-composer-core | Apr 1, 2025 | Mar 21, 2025 |
| Alpine Linux | — | Upgrade rclone | Aug 8, 2025 | Mar 21, 2025 |
| Amazon Linux Ami 2 | — | Upgrade dockerUpgrade runfinch-finchUpgrade docker-debuginfoUpgrade amazon-cloudwatch-agent | Apr 30, 2025 | Mar 21, 2025 |
| Amazon_linux_2023 | — | Upgrade amazon-cloudwatch-agentUpgrade dockerUpgrade runfinch-finchUpgrade docker-debuginfoUpgrade docker-debugsource | Apr 30, 2025 | Mar 21, 2025 |
| Debian | — | Upgrade golang-github-golang-jwt-jwtUpgrade golang-github-golang-jwt-jwt-v5 | May 15, 2025 | Mar 21, 2025 |
| Freebsd | — | Upgrade gitea | Apr 2, 2025 | Mar 31, 2025 |
| Oracle_linux | — | Upgrade grafana-selinuxUpgrade osbuild-composerUpgrade osbuild-composer-workerUpgrade osbuild-composer-coreUpgrade grafana | Mar 28, 2025 | Mar 21, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Mar 21, 2025 |
| Redhat_linux | — | Upgrade osbuild-composer-tests-debuginfoUpgrade grafana-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade grafana-selinuxUpgrade osbuild-composer-debugsourceUpgrade osbuild-composerUpgrade osbuild-composer-core-debuginfoUpgrade opentelemetry-collectorUpgrade osbuild-composer-coreUpgrade grafana-debugsourceUpgrade grafanaUpgrade osbuild-composer-workerUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-debuginfo | Mar 28, 2025 | Mar 21, 2025 |
| Rocky_linux | — | Upgrade grafana-selinuxUpgrade osbuild-composerUpgrade grafana-debuginfoUpgrade opentelemetry-collectorUpgrade osbuild-composer-workerUpgrade grafanaUpgrade grafana-debugsourceUpgrade osbuild-composer-core | Jul 31, 2025 | Jul 29, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.5Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 10.4.1Upgrade Splunk Enterprise to version 10.0.8Upgrade Splunk Enterprise to version 9.4.13Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.3.10 | Mar 20, 2026 | Mar 21, 2025 |
| Suse | — | Upgrade govulncheck-vulndbUpgrade rclone-zsh-completionUpgrade rekorUpgrade etcdctlUpgrade etcdUpgrade rclone-bash-completionUpgrade etcdutlUpgrade amber-cliUpgrade rclone | Dec 5, 2025 | Mar 29, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub