CVE catalog
CVE-2025-30204
golang-github-golang-jwt-jwt: CVE-2025-30204
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.81% · Oct 25, 2026
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-github-golang-jwt-jwt | sid | 5.0.0+really4.5.2-1 | fixed |
| Debian | golang-github-golang-jwt-jwt | forky | 5.0.0+really4.5.2-1 | fixed |
| Debian | golang-github-golang-jwt-jwt | trixie | 5.0.0+really4.5.2-1 | fixed |
| Debian | golang-github-golang-jwt-jwt | bookworm | 4.4.3-1 | vulnerable |
| Go | github.com/golang-jwt/jwt/v5 | Not reported | 5.2.2 | fixed |
| Go | github.com/golang-jwt/jwt/v4 | Not reported | 4.5.2 | fixed |
| Go | github.com/golang-jwt/jwt | Not reported | Not reported | unknown |
| Go | github.com/golang-jwt/jwt | Not reported | Not reported | unknown |
| Opensuse | docker-stable | leap 16.0 | 24.0.9_ce-160000.4.1 | fixed |
| Opensuse | zot-registry | tumbleweed | 2.1.14-1.1 | fixed |
| Opensuse | zli | tumbleweed | 2.1.14-1.1 | fixed |
| Opensuse | digger-cli | tumbleweed | 0.6.127-1.1 | fixed |
| Opensuse | traefik2 | tumbleweed | 2.11.28-1.1 | fixed |
| Opensuse | traefik | tumbleweed | 3.5.0-1.1 | fixed |
| Suse | docker-stable | linux enterprise module for containers 15 sp7 | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise high performance computing 15 sp4-espos | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise high performance computing 15 sp4-ltss | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise high performance computing 15 sp5-espos | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise high performance computing 15 sp5-ltss | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise server 15 sp4-ltss | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise server 15 sp5-ltss | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise server 15 sp6-ltss | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise server for sap applications 15 sp4 | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise server for sap applications 15 sp5 | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | docker-stable | linux enterprise server for sap applications 15 sp6 | 24.0.9_ce-150000.1.36.1 | fixed |
| Opensuse | docker-stable | leap 15.6 | 24.0.9_ce-150000.1.36.1 | fixed |
| Suse | amber-cli | linux enterprise module for server applications 15 sp6 | 1.13.1+git20250329.c2e3bb8-150600.3.3.1 | fixed |
| Suse | amber-cli | linux enterprise module for server applications 15 sp7 | 1.13.1+git20250329.c2e3bb8-150600.3.3.1 | fixed |
| Opensuse | amber-cli | leap 15.6 | 1.13.1+git20250329.c2e3bb8-150600.3.3.1 | fixed |
| Opensuse | kubeshark-cli | tumbleweed | 53.1.0-1.1 | fixed |
| Suse | docker-stable | linux enterprise server 12 sp5-ltss | 24.0.9_ce-1.29.1 | fixed |
| Suse | docker-stable | linux enterprise server ltss extended security 12 sp5 | 24.0.9_ce-1.29.1 | fixed |
| Opensuse | docker-stable | tumbleweed | 24.0.9_ce-17.1 | fixed |
| Opensuse | etcd | tumbleweed | 3.5.21-1.1 | fixed |
| Opensuse | gotosocial | tumbleweed | 0.18.3-2.1 | fixed |
| Opensuse | flannel | tumbleweed | 0.26.6-1.1 | fixed |
| Opensuse | headscale | tumbleweed | 0.25.1-2.1 | fixed |
| Opensuse | etcd | leap 15.6 | 3.5.21-150000.7.12.1 | fixed |
| Ubuntu | golang-github-golang-jwt-jwt | 22.04 | 4.1.0-1 | vulnerable |
| Ubuntu | golang-github-golang-jwt-jwt | 22.04 | 4.1.0-2 | vulnerable |
| Ubuntu | golang-github-golang-jwt-jwt | 22.04 | 4.2.0-1 | vulnerable |
| Ubuntu | golang-github-golang-jwt-jwt | 22.04 | 4.2.0-1ubuntu0.1 | vulnerable |
| Ubuntu | golang-github-golang-jwt-jwt | 24.04 | 4.4.3-1build1 | vulnerable |
| Ubuntu | golang-github-golang-jwt-jwt | 24.04 | 5.0.0+really4.5.0-1 | vulnerable |
| Ubuntu | golang-github-golang-jwt-jwt-v5 | 24.04 | 5.2.0-2 | vulnerable |
| Opensuse | amber-cli | tumbleweed | 1.13.1+git20250329.c2e3bb8-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-github-golang-jwt-jwt | source | sid | 5.0.0+really4.5.2-1 | not yet assigned | Not reported | Not reported |
| Debian | golang-github-golang-jwt-jwt | source | forky | 5.0.0+really4.5.2-1 | not yet assigned | Not reported | Not reported |
| Debian | golang-github-golang-jwt-jwt | source | trixie | 5.0.0+really4.5.2-1 | not yet assigned | Not reported | Not reported |
| Debian | golang-github-golang-jwt-jwt | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Go | github.com/golang-jwt/jwt/v5 | Go | Not reported | 5.2.2 | Not reported | GHSA-MH63-6H87-95CP | Not reported |
| Go | github.com/golang-jwt/jwt/v4 | Go | Not reported | 4.5.2 | Not reported | GHSA-MH63-6H87-95CP | Not reported |
| Opensuse | docker-stable | rpm | leap 16.0 | 24.0.9_ce-160000.4.1 | Not reported | OPENSUSE-SU-2026:20366-1 | Not reported |
| Opensuse | zot-registry | rpm | tumbleweed | 2.1.14-1.1 | Not reported | OPENSUSE-SU-2026:10100-1 | Not reported |
| Opensuse | zli | rpm | tumbleweed | 2.1.14-1.1 | Not reported | OPENSUSE-SU-2026:10099-1 | Not reported |
| Opensuse | digger-cli | rpm | tumbleweed | 0.6.127-1.1 | Not reported | OPENSUSE-SU-2025:15606-1 | Not reported |
| Opensuse | traefik2 | rpm | tumbleweed | 2.11.28-1.1 | Not reported | OPENSUSE-SU-2025:15419-1 | Not reported |
| Opensuse | traefik | rpm | tumbleweed | 3.5.0-1.1 | Not reported | OPENSUSE-SU-2025:15418-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise module for containers 15 sp7 | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise high performance computing 15 sp4-espos | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise high performance computing 15 sp4-ltss | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise high performance computing 15 sp5-espos | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise high performance computing 15 sp5-ltss | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise server 15 sp4-ltss | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise server 15 sp5-ltss | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise server 15 sp6-ltss | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise server for sap applications 15 sp4 | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise server for sap applications 15 sp5 | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise server for sap applications 15 sp6 | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Opensuse | docker-stable | rpm | leap 15.6 | 24.0.9_ce-150000.1.36.1 | Not reported | SUSE-SU-2026:0659-1 | Not reported |
| Suse | amber-cli | rpm | linux enterprise module for server applications 15 sp6 | 1.13.1+git20250329.c2e3bb8-150600.3.3.1 | Not reported | SUSE-SU-2025:02769-1 | Not reported |
| Suse | amber-cli | rpm | linux enterprise module for server applications 15 sp7 | 1.13.1+git20250329.c2e3bb8-150600.3.3.1 | Not reported | SUSE-SU-2025:02769-1 | Not reported |
| Opensuse | amber-cli | rpm | leap 15.6 | 1.13.1+git20250329.c2e3bb8-150600.3.3.1 | Not reported | SUSE-SU-2025:02769-1 | Not reported |
| Opensuse | kubeshark-cli | rpm | tumbleweed | 53.1.0-1.1 | Not reported | OPENSUSE-SU-2026:10302-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise server 12 sp5-ltss | 24.0.9_ce-1.29.1 | Not reported | SUSE-SU-2026:0641-1 | Not reported |
| Suse | docker-stable | rpm | linux enterprise server ltss extended security 12 sp5 | 24.0.9_ce-1.29.1 | Not reported | SUSE-SU-2026:0641-1 | Not reported |
| Opensuse | docker-stable | rpm | tumbleweed | 24.0.9_ce-17.1 | Not reported | OPENSUSE-SU-2026:10255-1 | Not reported |
| Opensuse | etcd | rpm | tumbleweed | 3.5.21-1.1 | Not reported | OPENSUSE-SU-2025:14973-1 | Not reported |
| Opensuse | gotosocial | rpm | tumbleweed | 0.18.3-2.1 | Not reported | OPENSUSE-SU-2025:14954-1 | Not reported |
| Opensuse | flannel | rpm | tumbleweed | 0.26.6-1.1 | Not reported | OPENSUSE-SU-2025:14989-1 | Not reported |
| Opensuse | headscale | rpm | tumbleweed | 0.25.1-2.1 | Not reported | OPENSUSE-SU-2025:14956-1 | Not reported |
| Opensuse | etcd | rpm | leap 15.6 | 3.5.21-150000.7.12.1 | Not reported | SUSE-SU-2025:1285-1 | Not reported |
| Opensuse | amber-cli | rpm | tumbleweed | 1.13.1+git20250329.c2e3bb8-1.1 | Not reported | OPENSUSE-SU-2025:15037-1 | Not reported |
Notes
[bookworm] golang-github-golang-jwt-jwt: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [golang-github-golang-jwt-jwt-dev]Affected
Source package: [golang-github-golang-jwt-jwt]
Details (2)
4.4.3-1· all · bookwormAffected
dsa · golang-github-golang-jwt-jwt · debian · bookworm; dsa · golang-github-golang-jwt-jwt · debian · 12
4.4.3-1· all · bookwormAffected
dsa · golang-github-golang-jwt-jwt · debian · bookworm; dsa · golang-github-golang-jwt-jwt · debian · 12
- [jwt]Affected
Source package: [golang-github-golang-jwt-jwt]
Details (2)
4.4.3-1+b4· amd64 · bookwormAffected
dsa · golang-github-golang-jwt-jwt · debian · bookworm; dsa · golang-github-golang-jwt-jwt · debian · 12
4.4.3-1+b4· arm64 · bookwormAffected
dsa · golang-github-golang-jwt-jwt · debian · bookworm; dsa · golang-github-golang-jwt-jwt · debian · 12
[openSUSE Tumbleweed]
- [digger-cli-bash-completion]Unknown
Source package: [digger-cli]
Details (1)
0.6.149-1.1· noarch · tumbleweedUnknown · Fixed:
0.6.127-1.1Version impact unknown
dsa · digger-cli · opensuse · tumbleweed
- [digger-cli-fish-completion]Unknown
Source package: [digger-cli]
Details (1)
0.6.149-1.1· noarch · tumbleweedUnknown · Fixed:
0.6.127-1.1Version impact unknown
dsa · digger-cli · opensuse · tumbleweed
- [digger-cli-zsh-completion]Unknown
Source package: [digger-cli]
Details (1)
0.6.149-1.1· noarch · tumbleweedUnknown · Fixed:
0.6.127-1.1Version impact unknown
dsa · digger-cli · opensuse · tumbleweed
- [docker-stable-bash-completion]Unknown
Source package: [docker-stable]
Details (1)
24.0.9_ce-19.3· noarch · tumbleweedUnknown · Fixed:
24.0.9_ce-17.1Version impact unknown
dsa · docker-stable · opensuse · tumbleweed
- [docker-stable-buildx]Unknown
Source package: [docker-stable]
Details (1)
0.25.0-19.3· x86_64 · tumbleweedUnknown · Fixed:
24.0.9_ce-17.1Version impact unknown
dsa · docker-stable · opensuse · tumbleweed
- [docker-stable-fish-completion]Unknown
Source package: [docker-stable]
Details (1)
24.0.9_ce-19.3· noarch · tumbleweedUnknown · Fixed:
24.0.9_ce-17.1Version impact unknown
dsa · docker-stable · opensuse · tumbleweed
- [docker-stable-rootless-extras]Unknown
Source package: [docker-stable]
Details (1)
24.0.9_ce-19.3· noarch · tumbleweedUnknown · Fixed:
24.0.9_ce-17.1Version impact unknown
dsa · docker-stable · opensuse · tumbleweed
- [docker-stable-zsh-completion]Unknown
Source package: [docker-stable]
Details (1)
24.0.9_ce-19.3· noarch · tumbleweedUnknown · Fixed:
24.0.9_ce-17.1Version impact unknown
dsa · docker-stable · opensuse · tumbleweed
- [etcdctl]Unknown
Source package: [etcd]
Details (1)
3.7.1-1.2· x86_64 · tumbleweedUnknown · Fixed:
3.5.21-1.1Version impact unknown
dsa · etcd · opensuse · tumbleweed
- [etcdutl]Unknown
Source package: [etcd]
Details (1)
3.7.1-1.2· x86_64 · tumbleweedUnknown · Fixed:
3.5.21-1.1Version impact unknown
dsa · etcd · opensuse · tumbleweed
- [flannel-k8s-yaml]Unknown
Source package: [flannel]
Details (1)
0.28.7-1.2· noarch · tumbleweedUnknown · Fixed:
0.26.6-1.1Version impact unknown
dsa · flannel · opensuse · tumbleweed
- [kubeshark-cli-bash-completion]Unknown
Source package: [kubeshark-cli]
Details (1)
53.4.0-1.1· noarch · tumbleweedUnknown · Fixed:
53.1.0-1.1Version impact unknown
dsa · kubeshark-cli · opensuse · tumbleweed
- [kubeshark-cli-fish-completion]Unknown
Source package: [kubeshark-cli]
Details (1)
53.4.0-1.1· noarch · tumbleweedUnknown · Fixed:
53.1.0-1.1Version impact unknown
dsa · kubeshark-cli · opensuse · tumbleweed
- [kubeshark-cli-zsh-completion]Unknown
Source package: [kubeshark-cli]
Details (1)
53.4.0-1.1· noarch · tumbleweedUnknown · Fixed:
53.1.0-1.1Version impact unknown
dsa · kubeshark-cli · opensuse · tumbleweed
- [zli-bash-completion]Unknown
Source package: [zli]
Details (1)
2.1.20-1.1· noarch · tumbleweedUnknown · Fixed:
2.1.14-1.1Version impact unknown
dsa · zli · opensuse · tumbleweed
- [zli-fish-completion]Unknown
Source package: [zli]
Details (1)
2.1.20-1.1· noarch · tumbleweedUnknown · Fixed:
2.1.14-1.1Version impact unknown
dsa · zli · opensuse · tumbleweed
- [zli-zsh-completion]Unknown
Source package: [zli]
Details (1)
2.1.20-1.1· noarch · tumbleweedUnknown · Fixed:
2.1.14-1.1Version impact unknown
dsa · zli · opensuse · tumbleweed
- [zot-registry-bash-completion]Unknown
Source package: [zot-registry]
Details (1)
2.1.20-1.1· noarch · tumbleweedUnknown · Fixed:
2.1.14-1.1Version impact unknown
dsa · zot-registry · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21481-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-30204]
- [https://osv.dev/vulnerability/GHSA-mh63-6h87-95cp]
- [https://osv.dev/vulnerability/SUSE-SU-2025:02769-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:1285-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:0641-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:0659-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-30204]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14954-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14956-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14973-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14989-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15037-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15418-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15419-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15606-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10099-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10100-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10255-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10302-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20366-1]
- [https://security-tracker.debian.org/tracker/CVE-2025-30204]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-30204.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0633.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]