CVE-2025-30204

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.

• CWE-405

• https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3
• https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb
• https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp
• https://security.netapp.com/advisory/ntap-20250404-0002/

Published

Mar 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30199ECOVACS vacuum robot base stations do not validate firmware …7.5
• CVE-2025-3020An low privileged remote Attacker can execute arbitrary web …5.4
• CVE-2025-30200ECOVACS robot vacuums and base stations communicate via an i…6.3
• CVE-2025-30201Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2025-30202vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2025-30203Tuleap is an Open Source Suite to improve management of soft…4.8
• CVE-2025-30205kanidim-provision is a helper utility that uses kanidm's API…7.6
• CVE-2025-30206Dpanel is a Docker visualization panel system which provides…9.8
• CVE-2025-30207Kirby is an open-source content management system. A vulnera…7.5
• CVE-2025-30208Vite, a provider of frontend development tooling, has a vuln…7.5
• CVE-2025-30209Tuleap is an Open Source Suite to improve management of soft…5.3
• CVE-2025-3021Path Traversal vulnerability in e-solutions e-management. Th…8.7