PT-2025-12455 · Unknown+9 · Golang-Jwt+9
Zimbatm
·
Published
2025-03-21
·
Updated
2026-05-13
·
CVE-2025-30204
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
golang-jwt versions prior to 4.5.2
golang-jwt versions prior to 5.2.2
Description
The issue affects the
parse.ParseUnverified function, which splits untrusted data on periods. This can lead to allocations of O(n) bytes when faced with a malicious request containing many period characters in the Authorization header.Recommendations
For versions prior to 4.5.2, update to version 4.5.2 or later.
For versions prior to 5.2.2, update to version 5.2.2 or later.
As a temporary workaround, consider restricting the length of the Authorization header to prevent excessive allocations.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Red Hat
Red Os
Rocky Linux
Suse
Golang-Jwt