Skip to main content

Asymmetric Resource Consumption (Amplification) in gitee.com/zhouaowen/jwt/v4

CVE-2025-30204

  • gitee.com/zhouaowen/jwt/v4
  • github.com/golang-jwt/jwt
  • github.com/golang-jwt/jWt
  • github.com/golang-jwt/jwt/v4
  • github.com/golang-jwt/jwt/v5
  • golang-jwt/jwt
  • gopkg.in/golang-jwt/jwt.v3
High
8.7/10

Summary

The package golang-jwt is a Go implementation of JSON Web Tokens. The function `parse.ParseUnverified` splits (via a call to `strings.Split`) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of `Bearer` followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue affects versions prior to 4.5.2, 5.x prior to 5.2.2.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-405 - Asymmetric Resource Consumption (Amplification)

Software that does not appropriately monitor or control resource consumption can lead to adverse system performance.

References

Advisory Timeline

  • Published