Skip to content
OpenAdvisories
High · 7.5 CVE-2025-30204 EUVD-2025-7207GHSA-mh63-6h87-95cpGO-2025-3553

jwt-go allows excessive memory allocation during header parsing

Published Mar 21, 2025 · Updated Apr 10, 2025 · Assigned by GitHub_M

Vendor: golang-jwt Product: jwt Package: aactl Package: actions-runner-controller Package: actions-runner-controller-compat Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-all Package: amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard Package: amazon-cloudwatch-agent-compat Package: amazon-cloudwatch-agent-config-downloader Package: amazon-cloudwatch-agent-config-translator Package: amazon-cloudwatch-agent-operator Package: amazon-cloudwatch-agent-operator-compat Package: amazon-cloudwatch-agent-start-amazon-cloudwatch-agent Package: application-gateway-kubernetes-ingress Package: argo-events Package: argo-rollouts Package: argo-workflows Package: argocd-image-updater Package: argocd-image-updater-compat Package: atlantis Package: aws-eks-pod-identity-agent Package: aws-eks-pod-identity-agent-compat Package: azcopy Package: azcopy Package: bank-vaults Package: bank-vaults-template Package: blobfuse2 Package: boring-registry Package: buildctl Package: buildkitd Package: cert-manager Package: cf-cli Package: chartmuseum Package: chezmoi Package: coredns Package: cortex Package: cosign Package: crossplane-crank Package: crossplane-provider-azure-authorization Package: crossplane-provider-azure-authorization-compat Package: crossplane-provider-azure-managedidentity Package: crossplane-provider-azure-managedidentity-compat Package: crossplane-provider-azure-sql Package: crossplane-provider-azure-sql-compat Package: crossplane-provider-azure-storage Package: crossplane-provider-azure-storage-compat Package: crossplane-provider-family-azure Package: crossplane-provider-family-azure-compat Package: dcos-cli Package: dgraph Package: distribution Package: docker-dind Package: eksctl Package: etcd Package: falcoctl Package: falcosidekick Package: filebrowser Package: filebrowser-compat Package: flannel Package: fluent-bit-plugin-loki Package: flux Package: flux-image-automation-controller Package: flux-image-automation-controller-compat Package: flux-image-automation-controller-iamguarded-compat Package: flux-image-reflector-controller Package: flux-image-reflector-controller-iamguarded-compat Package: flux-kustomize-controller Package: flux-kustomize-controller-iamguarded-compat Package: flux-notification-controller Package: flux-notification-controller-iamguarded-compat Package: flux-source-controller Package: flux-source-controller-iamguarded-compat Package: flyte Package: fulcio Package: git-sync Package: git-sync-compat Package: gitea Package: gitea-compat Package: github.com/golang-jwt/jwt Package: github.com/golang-jwt/jwt/v4 Package: github.com/golang-jwt/jwt/v5 Package: gitness Package: gitsign Package: gitsign-config Package: gitsign-credential-cache Package: glab Package: golang-github-golang-jwt-jwt Package: golang-github-golang-jwt-jwt Package: golang-github-golang-jwt-jwt-v5 Package: golang-github-golang-jwt-jwt-v5 Package: gomplate Package: goreleaser Package: grafana-agent-operator Package: grafana-alloy Package: grafana-mimir Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: harbor-registry Package: hydra Package: influxdb Package: jitsucom-bulker Package: jitsucom-bulker-bulker Package: jitsucom-bulker-bulker-compat Package: jitsucom-bulker-ingest Package: jitsucom-bulker-ingest-compat Package: jitsucom-bulker-ingmgr Package: jitsucom-bulker-ingmgr-compat Package: jitsucom-bulker-sidecar Package: jitsucom-bulker-sidecar-compat Package: jitsucom-bulker-syncctl Package: jitsucom-bulker-syncctl-compat Package: juicefs-1.3 Package: jx Package: k3s Package: k3s-1.32 Package: k3s-multicall Package: k3s-multicall-1.32 Package: k3s-static Package: k3s-static-1.32 Package: k8sgpt Package: kaniko Package: kaniko-compat Package: kaniko-warmer Package: kaniko-warmer-compat Package: kargo Package: kargo-oci-compat Package: katib-controller Package: katib-controller-compat Package: katib-db-manager Package: katib-db-manager-compat Package: katib-earlystopping Package: katib-file-metricscollector Package: katib-file-metricscollector-compat Package: katib-suggestion-goptuna Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: keda Package: kine Package: ko Package: kots Package: kots-compat Package: kots-symlink-compat Package: ksops Package: ksops-compat Package: kube-metrics-adapter Package: kube-vip-cloud-provider Package: kubectl-1.28 Package: kubectl-1.28-default Package: kubectl-1.29 Package: kubectl-1.29-default Package: kubectl-argo-rollouts Package: kubectl-bash-completion-1.28 Package: kubectl-bash-completion-1.29 Package: kubeflow-katib Package: kubernetes Package: kubernetes-dashboard-auth Package: kubernetes-dashboard-auth-compat Package: kubescape Package: kubevirt Package: kyverno-notation-aws Package: kyverno-notation-aws-compat Package: kyverno-policy-reporter-ui Package: kyverno-policy-reporter-ui-compat Package: mc Package: mc-iamguarded-2025-compat Package: minio Package: minio-iamguarded-2025-compat Package: minio-operator-sidecar Package: moby-engine Package: mongo-tools Package: nmi Package: nuclei Package: oauth2-proxy Package: oauth2-proxy-iamguarded-compat Package: octo-sts Package: octo-sts-webhook Package: op-geth Package: op-geth-abigen Package: op-geth-clef Package: op-geth-compat Package: op-geth-devp2p Package: op-geth-evm Package: op-geth-rlpdump Package: openbao Package: openbao-compat Package: opencost Package: opencost-compat Package: openfga Package: openfga-compat Package: openfga-healthcheck-compat Package: opentelemetry-collector Package: opentelemetry-collector-compat Package: opentelemetry-collector-contrib Package: opentelemetry-collector-contrib-compat Package: opentelemetry-collector-ocb Package: opentelemetry-operator Package: opentelemetry-operator-compat Package: opentelemetry-operator-otel-allocator Package: opentelemetry-operator-otel-allocator-compat Package: opentofu-1.9 Package: packer Package: policy-controller Package: policy-controller-tester Package: prometheus Package: prometheus-3.2 Package: promxy Package: pulumi Package: pulumi-kubernetes-operator Package: pulumi-language-go Package: pulumi-language-nodejs Package: pulumi-language-python Package: rclone Package: rclone Package: rclone-compat Package: rekor Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: restic Package: restic-compat Package: rook Package: rook Package: rook-oci-compat Package: scorecard Package: seaweedfs Package: seaweedfs-iamguarded-compat Package: seaweedfs-oci-entrypoint Package: secrets-store-csi-driver-provider-azure Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: sigstore-scaffolding Package: sigstore-scaffolding-cloudsqlproxy Package: sigstore-scaffolding-ctlog-createctconfig Package: sigstore-scaffolding-ctlog-managectroots Package: sigstore-scaffolding-ctlog-verifyfulcio Package: sigstore-scaffolding-fulcio-createcerts Package: sigstore-scaffolding-getoidctoken Package: sigstore-scaffolding-rekor-createsecret Package: sigstore-scaffolding-trillian-createdb Package: sigstore-scaffolding-trillian-createtree Package: sigstore-scaffolding-trillian-updatetree Package: sigstore-scaffolding-tsa-createcertchain Package: sigstore-scaffolding-tuf-createsecret Package: sigstore-scaffolding-tuf-server Package: skaffold Package: sops Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: splunk-otel-collector Package: splunk-otel-collector-compat Package: splunk-otel-collector-doc Package: sql_exporter Package: step Package: step-ca Package: step-kms-plugin Package: tdbg Package: tdbg-compat Package: tekton-chains Package: telegraf Package: temporal-cassandra-tool Package: temporal-cassandra-tool-compat Package: temporal-server Package: temporal-server-compat Package: temporal-server-oci-entrypoint Package: temporal-server-schema Package: temporal-sql-tool Package: temporal-sql-tool-compat Package: terraform Package: terraform Package: terraform-compat Package: terraform-local-provider-config Package: terraform-provider-azapi Package: terraform-provider-azurerm Package: terragrunt Package: terragrunt-docs Package: thanos Package: thanos-iamguarded-compat Package: timestamp-authority Package: timestamp-authority-cli Package: timestamp-authority-server Package: tkn Package: traefik-3.3 Package: trivy Package: trufflehog Package: velero Package: velero-compat Package: velero-plugin-for-microsoft-azure Package: velero-plugin-for-microsoft-azure-compat Package: velero-restore-helper Package: vexctl Package: wal-g Package: wal-g-pg Package: weaviate Package: xeol Package: xeol-compat Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.

Affected products

VendorProductAffectedFixed
golang-jwt jwt >= 3.2.0, < 4.5.2, >= 5.0.0-rc.1, < 5.2.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-github-golang-jwt-jwt 5.0.0+really4.5.2-1 —
Debian 14 golang-github-golang-jwt-jwt-v5 5.2.2-1 —
Debian 13 golang-github-golang-jwt-jwt 5.0.0+really4.5.2-1 —
Debian 13 golang-github-golang-jwt-jwt-v5 5.2.2-1 —
Debian 12 golang-github-golang-jwt-jwt No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS golang-github-golang-jwt-jwt +1 No fix yet —
Ubuntu 22.04 LTS golang-github-golang-jwt-jwt No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 grafana +1 10.2.6-15.el10_0 RHSA-2025:7475
RHEL 10 opentelemetry-collector 0.107.0-9.el10_0 RHSA-2025:7479
RHEL 10 osbuild-composer +2 134.1-1.el10_0 RHSA-2025:7503
RHEL 9 grafana +1 10.2.6-9.el9_5 RHSA-2025:7404, RHSA-2025:3344
RHEL 9 opentelemetry-collector 0.107.0-8.el9_6 RHSA-2025:7407, RHSA-2025:3411
RHEL 9 osbuild-composer +2 118.2-1.el9_5 RHSA-2025:7425, RHSA-2025:4669
RHEL 8 osbuild-composer +2 101-3.el8_10 RHSA-2025:7967
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS grafana +1 9.2.10-22.el9_4 RHSA-2025:3618
RHEL 9.4 EUS opentelemetry-collector 0.107.0-8.el9_4 RHSA-2025:3698
RHEL 9.4 EUS osbuild-composer +2 101.3-1.el9_4 RHSA-2025:4462
RHEL 9.2 EUS grafana 9.0.9-6.el9_2 RHSA-2025:3616
RHEL 9.2 EUS osbuild-composer +3 76.1-1.el9_2 RHSA-2025:4569
RHEL 9.0 E4S osbuild-composer +3 46.3-3.el9_0 RHSA-2025:8267
RHEL 8.8 EUS osbuild-composer +3 75-3.el8_8 RHSA-2025:8075
Red Hat Openshift Service On Aws 1 rosa +1 1.2.53-5be4e19.el8 RHEA-2025:4438
Red Hat Ceph Storage 9 ceph +27 2:20.1.0-144.el9cp RHSA-2026:1536

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 grafana +1 10.2.6-15.el10_0 ALSA-2025:7475
AlmaLinux 9 grafana +1 10.2.6-9.el9_5 ALSA-2025:7404, ALSA-2025:3344
AlmaLinux 9 osbuild-composer +2 118.2-1.el9_5.alma.1 ALSA-2025:7425, ALSA-2025:4669
AlmaLinux 8 osbuild-composer +2 101-3.el8_10.alma.1 ALSA-2025:7967

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 opentelemetry-collector 0.107.0-9.el10_0 RLSA-2025:7479
Rocky Linux 9 grafana 10.2.6-9.el9_5 RLSA-2025:3344
Rocky Linux 9 opentelemetry-collector 0.107.0-10.el9_5 RLSA-2025:3411
Rocky Linux 8 osbuild-composer 101-3.el8_10.rocky.0.6 RLSA-2025:7967

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 amber-cli 1.13.1+git20250329.c2e3bb8-150600.3.3.1 SUSE-SU-2025:02769-1
SLES 15 SP7 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0972-1, SUSE-SU-2026:0659-1
SLES 15 SP6 amber-cli 1.13.1+git20250329.c2e3bb8-150600.3.3.1 SUSE-SU-2025:02769-1
SLES 15 SP6 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0659-1
SLES 15 SP6 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLES 15 SP5 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0659-1
SLES 15 SP5 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLES 15 SP4 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0659-1
SLES 15 SP4 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLES 12 SP5 docker-stable 24.0.9_ce-1.29.1 SUSE-SU-2026:1118-1, SUSE-SU-2026:0641-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0659-1
SLES for SAP 15 SP5 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0659-1
SLES for SAP 15 SP5 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLES for SAP 15 SP4 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0659-1
SLES for SAP 15 SP4 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLE HPC 15 SP5 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0659-1
SLE HPC 15 SP5 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SLE HPC 15 SP4 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0659-1
SLE HPC 15 SP4 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SUSE Manager Server 4.3 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
SUSE Manager Proxy 4.3 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed amber-cli 1.13.1+git20250329.c2e3bb8-1.1 openSUSE-SU-2025:15037-1
openSUSE Tumbleweed digger-cli 0.6.127-1.1 openSUSE-SU-2025:15606-1
openSUSE Tumbleweed docker-stable 24.0.9_ce-17.1 openSUSE-SU-2026:10255-1
openSUSE Tumbleweed etcd 3.5.21-1.1 openSUSE-SU-2025:14973-1
openSUSE Tumbleweed flannel 0.26.6-1.1 openSUSE-SU-2025:14989-1
openSUSE Tumbleweed gotosocial 0.18.3-2.1 openSUSE-SU-2025:14954-1
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250327T184518-1.1 openSUSE-SU-2025:14937-1
openSUSE Tumbleweed grafana 11.5.4-1.1 openSUSE-SU-2025:15052-1
openSUSE Tumbleweed headscale 0.25.1-2.1 openSUSE-SU-2025:14956-1
openSUSE Tumbleweed kubectl-retina 1.3.1-1.1 openSUSE-SU-2026:12297-1
openSUSE Tumbleweed kubeshark-cli 53.1.0-1.1 openSUSE-SU-2026:10302-1
openSUSE Tumbleweed kumactl 3.0.0-1.1 openSUSE-SU-2026:12300-1
openSUSE Tumbleweed rclone 1.69.2-1.1 openSUSE-SU-2025:15054-1
openSUSE Tumbleweed rekor 1.3.10-1.1 openSUSE-SU-2025:14990-1
openSUSE Tumbleweed traefik 3.5.0-1.1 openSUSE-SU-2025:15418-1
openSUSE Tumbleweed traefik2 2.11.28-1.1 openSUSE-SU-2025:15419-1
openSUSE Tumbleweed trivy 0.65.0-1.1 openSUSE-SU-2025:15454-1
openSUSE Tumbleweed velociraptor 0.7.0.4.git163.87ee3570-1.1 openSUSE-SU-2025:15307-1
openSUSE Tumbleweed vexctl 0.4.1+git78.f951e3a-1.1 openSUSE-SU-2026:10230-1
openSUSE Tumbleweed zli +1 2.1.14-1.1 openSUSE-SU-2026:10100-1, openSUSE-SU-2026:10099-1
openSUSE Leap 16.0 docker-stable 24.0.9_ce-160000.4.1 openSUSE-SU-2026:20366-1
openSUSE Leap 16.0 vexctl 0.4.4+git20.5d61136-160000.1.1 openSUSE-SU-2026:21481-1
openSUSE Leap 15.6 amber-cli 1.13.1+git20250329.c2e3bb8-150600.3.3.1 SUSE-SU-2025:02769-1
openSUSE Leap 15.6 docker-stable 24.0.9_ce-150000.1.36.1 SUSE-SU-2026:0972-1, SUSE-SU-2026:0659-1
openSUSE Leap 15.6 etcd 3.5.21-150000.7.12.1 SUSE-SU-2025:1285-1
openSUSE Leap 15.6 rekor 1.3.10-150400.4.25.1 SUSE-SU-2025:1332-1
openSUSE Leap 15.6 vexctl 0.4.1+git78.f951e3a-150000.1.11.1 SUSE-SU-2026:0592-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 rclone 1.69.3-r0 —
Alpine v3.23 rclone 1.69.3-r0 —
Alpine v3.22 rclone 1.69.3-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300054.1-2.amzn2023 ALAS2023-2025-968
Amazon Linux 2023 docker 25.0.8-1.amzn2023.0.3 ALAS2023-2025-945
Amazon Linux 2023 runfinch-finch 1.7.2-1.amzn2023.0.1 ALAS2023-2025-944
Amazon Linux 2 amazon-cloudwatch-agent 1.300054.1-2.amzn2 ALAS2-2025-2851

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 application-gateway-kubernetes-ingress 1.7.7-2 —
Azure Linux 3 azcopy 10.25.1-3 —
Azure Linux 3 blobfuse2 2.3.2-2 —
Azure Linux 3 cert-manager 1.12.15-3 —
Azure Linux 3 coredns 1.11.4-5 —
Azure Linux 3 dcos-cli 1.2.0-21 —
Azure Linux 3 etcd 3.5.21-1 —
Azure Linux 3 flannel 0.24.2-12 —
Azure Linux 3 influxdb 2.7.5-13 —
Azure Linux 3 keda 2.14.1-5 —
Azure Linux 3 kubernetes 1.30.10-4 —
Azure Linux 3 moby-engine 25.0.3-12 —
Azure Linux 3 packer 1.9.5-7 —
Azure Linux 3 prometheus 2.45.4-10 —
Azure Linux 3 telegraf 1.31.0-7 —
Azure Linux 2 (CBL-Mariner) application-gateway-kubernetes-ingress 1.4.0-27 —
Azure Linux 2 (CBL-Mariner) azcopy 10.25.1-5 —
Azure Linux 2 (CBL-Mariner) cert-manager 1.11.2-21 —
Azure Linux 2 (CBL-Mariner) cf-cli 8.4.0-27 —
Azure Linux 2 (CBL-Mariner) coredns 1.11.1-16 —
Azure Linux 2 (CBL-Mariner) dcos-cli 1.2.0-24 —
Azure Linux 2 (CBL-Mariner) etcd 3.5.21-1 —
Azure Linux 2 (CBL-Mariner) influxdb 2.6.1-30 —
Azure Linux 2 (CBL-Mariner) jx 3.2.236-25 —
Azure Linux 2 (CBL-Mariner) keda 2.4.0-32 —
Azure Linux 2 (CBL-Mariner) kube-vip-cloud-provider 0.0.2-26 —
Azure Linux 2 (CBL-Mariner) kubernetes 1.28.4-16 —
Azure Linux 2 (CBL-Mariner) kubevirt 0.59.0-38 —
Azure Linux 2 (CBL-Mariner) moby-engine 24.0.9-16 —
Azure Linux 2 (CBL-Mariner) nmi +1 No fix yet —
Azure Linux 2 (CBL-Mariner) packer 1.9.5-12 —
Azure Linux 2 (CBL-Mariner) prometheus 2.37.9-3 —
Azure Linux 2 (CBL-Mariner) telegraf 1.29.4-13 —
Azure Linux 2 (CBL-Mariner) terraform 1.3.2-24 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 grafana +1 10.2.6-18.el10_0 ELSA-2025-7475
Oracle Linux 10 osbuild-composer +2 134.1-2.0.1.el10_0 ELSA-2025-7503
Oracle Linux 9 grafana +1 10.2.6-9.el9_5 ELSA-2025-7404, ELSA-2025-3344
Oracle Linux 9 osbuild-composer +2 118.2-1.0.1.el9_5 ELSA-2025-7425, ELSA-2025-4669
Oracle Linux 8 osbuild-composer +2 101-3.0.1.el8_10 ELSA-2025-7967

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r29 —
Wolfi rolling actions-runner-controller +1 0.10.1-r7 —
Wolfi rolling amazon-cloudwatch-agent +6 1.300054.0-r2 —
Wolfi rolling amazon-cloudwatch-agent-operator +1 2.2.0-r2 —
Wolfi rolling argo-events +1 No fix yet —
Wolfi rolling argo-rollouts +1 1.8.2-r0 —
Wolfi rolling argo-workflows 3.6.5-r3 —
Wolfi rolling argocd-image-updater +1 0.15.2-r9 —
Wolfi rolling atlantis 0.33.0-r5 —
Wolfi rolling aws-eks-pod-identity-agent +1 0.1.23-r1 —
Wolfi rolling azcopy 10.28.0-r5 —
Wolfi rolling bank-vaults +1 1.20.4-r28 —
Wolfi rolling boring-registry 0.16.3-r2 —
Wolfi rolling buildctl +1 0.20.1-r4 —
Wolfi rolling chartmuseum 0.16.4-r0 —
Wolfi rolling chezmoi 2.60.1-r1 —
Wolfi rolling cortex 1.19.0-r4 —
Wolfi rolling cosign 2.4.3-r6 —
Wolfi rolling crossplane-crank 1.19.0-r5 —
Wolfi rolling crossplane-provider-azure-sql +9 1.11.2-r1 —
Wolfi rolling dgraph 24.1.1-r1 —
Wolfi rolling distribution 3.0.0-r34 —
Wolfi rolling docker-dind 28.0.2-r1 —
Wolfi rolling eksctl 0.205.0-r5 —
Wolfi rolling falcoctl 0.11.0-r7 —
Wolfi rolling falcosidekick 2.31.1-r6 —
Wolfi rolling filebrowser +1 2.32.0-r4 —
Wolfi rolling fluent-bit-plugin-loki 3.4.2-r5 —
Wolfi rolling flux 2.5.1-r4 —
Wolfi rolling flux-image-automation-controller +2 0.40.0-r4 —
Wolfi rolling flux-image-reflector-controller +1 0.34.0-r4 —
Wolfi rolling flux-kustomize-controller +1 1.5.1-r3 —
Wolfi rolling flux-notification-controller +1 1.5.0-r5 —
Wolfi rolling flux-source-controller +1 1.5.0-r8 —
Wolfi rolling flyte 1.16.1-r1 —
Wolfi rolling fulcio 1.6.6-r7 —
Wolfi rolling git-sync +1 4.4.0-r3 —
Wolfi rolling gitea +1 1.23.5-r2 —
Wolfi rolling gitness 3.3.0-r3 —
Wolfi rolling gitsign +2 0.12.0-r9 —
Wolfi rolling glab 1.54.0-r1 —
Wolfi rolling gomplate 4.3.1-r1 —
Wolfi rolling goreleaser 2.8.1-r1 —
Wolfi rolling grafana-agent-operator 0.44.2-r2 —
Wolfi rolling grafana-alloy 1.7.5-r2 —
Wolfi rolling grafana-mimir 2.15.1-r1 —
Wolfi rolling guac +4 0.14.0-r1 —
Wolfi rolling harbor-registry 3.0.0_alpha1-r26 —
Wolfi rolling hydra 2.3.0-r6 —
Wolfi rolling jitsucom-bulker +10 2.9.0-r1 —
Wolfi rolling k3s +2 1.32.2.1-r34 —
Wolfi rolling k3s-1.32 +2 1.32.6.1-r0 —
Wolfi rolling k8sgpt 0.4.1-r2 —
Wolfi rolling kaniko +3 1.23.2-r15 —
Wolfi rolling kargo +1 1.3.1-r4 —
Wolfi rolling kine 0.13.11-r1 —
Wolfi rolling ko 0.17.1-r10 —
Wolfi rolling kots +2 1.124.8-r1 —
Wolfi rolling ksops +1 4.3.3-r7 —
Wolfi rolling kube-metrics-adapter 0.2.6-r1 —
Wolfi rolling kubectl-1.28 +2 1.28.15-r12 —
Wolfi rolling kubectl-1.29 +2 1.29.15-r3 —
Wolfi rolling kubeflow-katib +17 0.17.0-r14 —
Wolfi rolling kubernetes-dashboard-auth +1 1.2.4-r4 —
Wolfi rolling kubescape 3.0.32-r2 —
Wolfi rolling kyverno-notation-aws +1 1.1-r10 —
Wolfi rolling kyverno-policy-reporter-ui +1 2.2.1-r2 —
Wolfi rolling mc +1 0.20250312.172924-r2 —
Wolfi rolling minio +1 0.20250312.180418-r2 —
Wolfi rolling minio-operator-sidecar 7.1.1-r4 —
Wolfi rolling mongo-tools 100.11.0-r8 —
Wolfi rolling nuclei 3.4.3-r0 —
Wolfi rolling oauth2-proxy +1 7.8.2-r0 —
Wolfi rolling octo-sts +1 0.4.2-r10 —
Wolfi rolling op-geth +6 1.101503.1-r1 —
Wolfi rolling openbao +1 2.2.0-r5 —
Wolfi rolling opencost +1 1.114.0-r4 —
Wolfi rolling openfga +2 1.8.8-r0 —
Wolfi rolling opentelemetry-collector +2 0.122.1-r1 —
Wolfi rolling opentelemetry-collector-contrib +1 0.122.0-r2 —
Wolfi rolling opentelemetry-operator +3 0.120.0-r4 —
Wolfi rolling opentofu-1.9 1.9.0-r8 —
Wolfi rolling policy-controller +1 0.12.0-r8 —
Wolfi rolling prometheus-3.2 3.2.1-r4 —
Wolfi rolling promxy 0.0.92-r34 —
Wolfi rolling pulumi +3 3.157.0-r1 —
Wolfi rolling pulumi-kubernetes-operator 1.16.0-r14 —
Wolfi rolling rclone +1 1.69.1-r5 —
Wolfi rolling rekor +3 1.3.9-r10 —
Wolfi rolling restic +1 0.17.3-r8 —
Wolfi rolling rook +1 1.16.5-r4 —
Wolfi rolling scorecard 5.1.1-r4 —
Wolfi rolling seaweedfs +2 3.85-r5 —
Wolfi rolling secrets-store-csi-driver-provider-azure 1.6.2-r33 —
Wolfi rolling sftpgo-plugin-kms 1.0.15-r3 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.14-r2 —
Wolfi rolling sigstore-scaffolding +13 0.7.21-r3 —
Wolfi rolling skaffold 2.14.2-r1 —
Wolfi rolling sops 3.9.4-r6 —
Wolfi rolling spire-agent +2 1.12.0-r0 —
Wolfi rolling splunk-otel-collector +2 0.121.0-r3 —
Wolfi rolling sql_exporter 0.17.1-r4 —
Wolfi rolling step 0.28.6-r1 —
Wolfi rolling step-ca 0.28.3-r1 —
Wolfi rolling step-kms-plugin 0.12.2-r1 —
Wolfi rolling tdbg +9 1.27.1-r4 —
Wolfi rolling tekton-chains 0.24.0-r6 —
Wolfi rolling terraform +2 1.5.7-r26 —
Wolfi rolling terraform-provider-azapi 2.3.0-r1 —
Wolfi rolling terraform-provider-azurerm 4.24.0-r1 —
Wolfi rolling terragrunt +1 0.76.5-r1 —
Wolfi rolling thanos +1 0.37.2-r8 —
Wolfi rolling timestamp-authority +2 1.2.4-r7 —
Wolfi rolling tkn 0.40.0-r5 —
Wolfi rolling traefik-3.3 3.3.4-r4 —
Wolfi rolling trivy 0.60.0-r5 —
Wolfi rolling trufflehog 3.88.18-r0 —
Wolfi rolling velero +2 1.15.2-r6 —
Wolfi rolling velero-plugin-for-microsoft-azure +1 1.11.1-r34 —
Wolfi rolling vexctl 0.3.0-r11 —
Wolfi rolling wal-g +1 3.0.7-r7 —
Wolfi rolling weaviate 1.29.1-r1 —
Wolfi rolling xeol +1 0.10.8-r5 —
Wolfi rolling zarf 0.50.0-r1 —
Wolfi rolling zot 2.1.10-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/golang-jwt/jwt >= 3.2.0, <= 3.2.2 — GHSA-mh63-6h87-95cp
Go github.com/golang-jwt/jwt all versions — GO-2025-3553
Go github.com/golang-jwt/jwt/v4 < 4.5.2 4.5.2 GHSA-mh63-6h87-95cp
Go github.com/golang-jwt/jwt/v5 >= 5.0.0-rc.1, < 5.2.2 5.2.2 GHSA-mh63-6h87-95cp

Advisories 50

References