jwt-go allows excessive memory allocation during header parsing
GHSA-mh63-6h87-95cp · CVE-2025-30204 · GO-2025-3553
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Summary
Function parse.ParseUnverified currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.
As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)
Details
Impact
Excessive memory allocation
References
- WEB https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-30204
- WEB https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3
- WEB https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb
- PACKAGE https://github.com/golang-jwt/jwt
- WEB https://security.netapp.com/advisory/ntap-20250404-0002
Ready to move
Start Securing
Free, no credit card | First findings in minutes