CVE-2025-30204
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Mar 21, 2025
Updated: Apr 4, 2025
CWE ID 405
Summary
CVE-2025-30204 affects the golang-jwt library used for implementing JSON Web Tokens in Go. Before versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits its untrusted argument, which is passed in the Authorization header, using strings.Split based on periods. Malicious requests with the "Bearer" prefix and multiple period characters lead to excessive memory allocations, with the extent of allocation depending on the length of the argument. This issue has been rectified in versions 5.2.2 and 4.5.2.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- JWT