CVE-2025-30204 jwt-go allows excessive memory allocation during header parsing
An attacker can cause excessive memory allocation and denial of service by sending a JWT with many periods in the Authorization header.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30204?
CVE-2025-30204 is a high-severity denial of service vulnerability in golang-jwt jwt, published on 21 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
Weakness: CWE-405
Which versions are affected by CVE-2025-30204?
9 open source packages ship an affected version, including github.com/golang-jwt/jwt, github.com/golang-jwt/jwt/v4 and github.com/golang-jwt/jwt/v5.
| Package | Affected | Fixed in |
|---|---|---|
github.com/golang-jwt/jwt Go | All versions | None |
github.com/golang-jwt/jwt Go | From 3.2.0 to 3.2.2 | None |
github.com/golang-jwt/jwt Go | From 3.2.0 to 3.2.2 | None |
github.com/golang-jwt/jwt/v4 Go | All versions | 4.5.2 |
github.com/golang-jwt/jwt/v4 Go | All versions | 4.5.2 |
github.com/golang-jwt/jwt/v4 Go | All versions | 4.5.2 |
3 more packages
github.com/golang-jwt/jwt/v5 Go | From 5.0.0-rc.1 | 5.2.2 |
github.com/golang-jwt/jwt/v5 Go | From 5.0.0-rc.1 | 5.2.2 |
github.com/golang-jwt/jwt/v5 Go | From 5.0.0-rc.1 | 5.2.2 |
Linux distribution packages (31)
grafana AlmaLinux:10 | All versions | 10.2.6-15.el10_0 |
grafana-selinux AlmaLinux:10 | All versions | 10.2.6-15.el10_0 |
osbuild-composer AlmaLinux:8 | All versions | 101-3.el8_10.alma.1 |
osbuild-composer-core AlmaLinux:8 | All versions | 101-3.el8_10.alma.1 |
osbuild-composer-worker AlmaLinux:8 | All versions | 101-3.el8_10.alma.1 |
grafana AlmaLinux:9 | All versions | 10.2.6-11.el9_6 |
grafana AlmaLinux:9 | All versions | 10.2.6-9.el9_5 |
grafana-selinux AlmaLinux:9 | All versions | 10.2.6-11.el9_6 |
grafana-selinux AlmaLinux:9 | All versions | 10.2.6-9.el9_5 |
osbuild-composer AlmaLinux:9 | All versions | 118.2-1.el9_5.alma.1 |
osbuild-composer AlmaLinux:9 | All versions | 132.2-1.el9_6.alma.1 |
osbuild-composer-core AlmaLinux:9 | All versions | 118.2-1.el9_5.alma.1 |
osbuild-composer-core AlmaLinux:9 | All versions | 132.2-1.el9_6.alma.1 |
osbuild-composer-worker AlmaLinux:9 | All versions | 118.2-1.el9_5.alma.1 |
osbuild-composer-worker AlmaLinux:9 | All versions | 132.2-1.el9_6.alma.1 |
grafana Red Hat:enterprise_linux:10.0 | All versions | 0:10.2.6-15.el10_0 |
grafana-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:10.2.6-15.el10_0 |
grafana-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:10.2.6-15.el10_0 |
grafana-selinux Red Hat:enterprise_linux:10.0 | All versions | 0:10.2.6-15.el10_0 |
osbuild-composer Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-1.el10_0 |
osbuild-composer-core Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-1.el10_0 |
osbuild-composer-core-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-1.el10_0 |
osbuild-composer-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-1.el10_0 |
osbuild-composer-tests-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-1.el10_0 |
osbuild-composer-worker Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-1.el10_0 |
osbuild-composer-worker-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:134.1-1.el10_0 |
osbuild-composer Red Hat:enterprise_linux:8::appstream | All versions | 0:101-3.el8_10 |
osbuild-composer-core Red Hat:enterprise_linux:8::appstream | All versions | 0:101-3.el8_10 |
osbuild-composer-core-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:101-3.el8_10 |
osbuild-composer-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:101-3.el8_10 |
osbuild-composer-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:101-3.el8_10 |
How do I fix CVE-2025-30204?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-30204 being exploited?
There is no known exploitation of CVE-2025-30204 in the wild and no public exploit code.
Sources
Also known as ALSA-2025:3344, ALSA-2025:4669, ALSA-2025:7404, ALSA-2025:7425, ALSA-2025:7475, ALSA-2025:7967 and 129 more.