CVE-2025-30204: jwt-go allows excessive memory allocation during header parsing
Summary
Function parse.ParseUnverified currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.
As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)
Details
See parse.ParseUnverified
Impact
Excessive memory allocation
Other sources
golang-jwt is a Go implementation of JSON Web Tokens. Prior to 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
— Red Hat
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/golang-jwt/jwt/v4to a version that resolves this vulnerability.Fixed in 4.5.2 - Upgrade
Upgrade
go/github.com/golang-jwt/jwt/v5to a version that resolves this vulnerability.Fixed in 5.2.2 - Upgrade
Upgrade
golang-jwt/jwt (parse.ParseUnverified)to a version that resolves this vulnerability.Fixed in 5.2.2 - Upgrade
Upgrade
golang-jwt/jwt (parse.ParseUnverified)to a version that resolves this vulnerability.Fixed in 4.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30204?
The severity of CVE-2025-30204 is considered high due to the potential for parsing attacks with untrusted data.
How do I fix CVE-2025-30204?
To fix CVE-2025-30204, upgrade to golang-jwt version 5.2.2 or jwt-go version 4.5.2 or later.
What systems are affected by CVE-2025-30204?
CVE-2025-30204 affects golang-jwt versions up to 5.2.2 and jwt-go versions up to 4.5.2.
What type of vulnerability is CVE-2025-30204?
CVE-2025-30204 is a parsing vulnerability related to the improper handling of untrusted data in JSON Web Tokens.
How can I determine if my application is vulnerable to CVE-2025-30204?
Check your application dependencies to see if you are using golang-jwt versions prior to 5.2.2 or jwt-go versions prior to 4.5.2.