Vulnerability CVE-2025-30204 detected, with github.com/golang-jwt/jwt/v4

[shravanjoshi88]

Vulnerability CVE-2025-30204 detected, base rating 7.5 (HIGH) of categosy Category "CWE-405 | Asymmetric Resource Consumption (Amplification)" is detected in github.com/golang-jwt/jwt/v4 v4.5.1 used in the project code.

Advisory: GHSA-mh63-6h87-95cp
Package: github.com/golang-jwt/jwt/v4
Affected versions< 4.5.2
Patched versions = 4.5.2

CVE Details
Published: Mar 21, 2025
The package golang-jwt is a Go implementation of JSON Web Tokens. The function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue affects versions through 4.2.1, 5.0.0-rc.1 through 5.2.2.

jwt-go allows excessive memory allocation during header parsing
Summary
Function parse.ParseUnverified currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)