Asymmetric Resource Consumption (Amplification) Affecting github.com/golang-jwt/jwt/v4 package, versions <4.5.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMGOLANGJWTJWTV4-9510921
- published23 Mar 2025
- disclosed21 Mar 2025
- creditjub0bs
Introduced: 21 Mar 2025
NewCVE-2025-30204 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/golang-jwt/jwt/v4 to version 4.5.2 or higher.
Overview
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) through the parse.ParseUnverified function. An attacker can cause excessive memory allocation by sending a crafted request with many period characters in the Authorization header.