Security Flaw in golang-jwt JSON Web Token Library Affecting Multiple Versions
CVE-2025-30204
7.5HIGH
What is CVE-2025-30204?
The golang-jwt library, used for JSON Web Tokens, has a vulnerability in the parse.ParseUnverified function that improperly handles untrusted data split on periods. An attacker can exploit this flaw by crafting a malicious Authorization header that includes excessive period characters. This results in inefficient memory allocation, potentially leading to denial-of-service conditions by exhausting server resources. This issue affects versions prior to 5.2.2 and 4.5.2. Immediate updates are recommended to safeguard against such attacks.
Affected Version(s)
jwt >= 3.2.0, < 4.5.2 < 3.2.0, 4.5.2
jwt >= 5.0.0-rc.1, < 5.2.2 < 5.0.0-rc.1, 5.2.2