{"id":"CVE-2024-51744","title":"golang-jwt: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (CVE-2024-517…","summary":"A flaw was found in the golang-jwt package. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are not checking errors in the way they should be. Especially, if a token is both expired and in…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","cvssSource":"vendor","cwe":"CWE-755","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","affected":["builds_for_red_hat_openshift","cert_manager_operator_for_red_hat_openshift","cryostat 3","custom_metric_autoscaler_operator_for_red_hat_openshift","logging_subsystem_for_red_hat_openshift","logical_volume_manager_storage","migration_toolkit_for_applications 7","migration_toolkit_for_containers","multicluster_engine_for_kubernetes","openshift_api_for_data_protection","openshift_developer_tools_and_services","openshift_pipelines","openshift_serverless","openshift_service_mesh 2","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ansible_automation_platform 2","ceph_storage 5","ceph_storage 6","ceph_storage 8","ceph_storage 9","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","openshift_ai_rhoai","openshift_cluster_manager_cli","openshift_container_platform 4","openshift_data_foundation 4","openshift_data_science_rhods","openshift_dev_spaces","openshift_gitops","openshift_on_aws","openshift_sandboxed_containers","openshift_virtualization 4","quay 3","trusted_artifact_signer","ceph_storage_7_1_tools","openshift_container_platform 4.15","openshift_container_platform 4.16"],"patched":["ceph_storage_7_1_tools","openshift_container_platform 4.15","openshift_container_platform 4.16","ceph_storage 8","ceph_storage 9"],"published":"2024-11-04","updated":"2026-09-19","sourceUpdated":"2026-09-19T18:15:07+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-51744.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-51744.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-51744"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2323735"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-51744"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51744"},{"url":"https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c"},{"url":"https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r"},{"url":"https://access.redhat.com/errata/RHSA-2026:2769"},{"url":"https://access.redhat.com/errata/RHSA-2025:11351"},{"url":"https://access.redhat.com/errata/RHSA-2025:11681"},{"url":"https://access.redhat.com/errata/RHSA-2026:2737"},{"url":"https://access.redhat.com/errata/RHSA-2026:3406"},{"url":"https://github.com/golang-jwt/jwt"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.0051,"epssPercentile":0.42367,"aliases":["GHSA-29wx-vh33-7x7r","GO-2024-3250"],"ecosystem":"go","ingestedAt":"2026-09-12T03:13:01.745Z","slug":"CVE-2024-51744","body":"## Overview\n\nA flaw was found in the golang-jwt package. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they can miss the embedded `jwt.ErrTokenSignatureInvalid`, and thus, potentially accept invalid tokens.\n\n## Vendor advisories\n\n- **RHSA-2026:2769** · Red Hat · fixed in: Red Hat Ceph Storage 7.1 Tools · released 2026-02-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:2769)\n- **RHSA-2025:11351** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2025-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2025:11351)\n- **RHSA-2025:11681** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2025-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2025:11681)\n- **RHSA-2026:2737** · Red Hat · fixed in: Red Hat Ceph Storage 8 · released 2026-02-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:2737)\n- **RHSA-2026:3406** · Red Hat · fixed in: Red Hat Ceph Storage 9 · released 2026-02-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:3406)\n- **Red Hat VEX** · Low · affected: Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Cryostat 3, Custom Metric Autoscaler operator for Red Hat Openshift, Logging Subsystem for Red Hat OpenShift, Logical Volume Manager Storage, … · no fix planned: Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Cryostat 3, Custom Metric Autoscaler operator for Red Hat Openshift, … · updated 2026-09-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-51744.json)\n\n**golang-jwt: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt** — rated Low by Red Hat. Released 2024-11-04, updated 2026-09-19.\n\nAffected:\n\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Cryostat 3\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Migration Toolkit for Applications 7\n- Migration Toolkit for Containers\n- Multicluster Engine for Kubernetes\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 6\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Cluster Manager CLI\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Data Science (RHODS)\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift on AWS\n- Red Hat Openshift Sandboxed Containers\n- Red Hat OpenShift Virtualization 4\n- Red Hat Quay 3\n- Red Hat Trusted Artifact Signer\n\nFixed:\n\n- Red Hat Ceph Storage 7.1 Tools\n- Red Hat OpenShift Container Platform 4.15\n- Red Hat OpenShift Container Platform 4.16\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n\nNo fix planned:\n\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Cryostat 3\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Migration Toolkit for Applications 7\n- Migration Toolkit for Containers\n- Multicluster Engine for Kubernetes\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 5\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Cluster Manager CLI\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Data Science (RHODS)\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift on AWS\n- Red Hat Openshift Sandboxed Containers\n- Red Hat OpenShift Virtualization 4\n- Red Hat Quay 3\n- Red Hat Trusted Artifact Signer\n- Red Hat Ceph Storage 6\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n\nNot affected:\n\n- Red Hat OpenShift Container Platform 4.15\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993 https://access.redhat.com/errata/RHSA-2026:2769\nFor OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as fol… https://access.redhat.com/errata/RHSA-2025:11351\nFor OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as fol… https://access.redhat.com/errata/RHSA-2025:11681\n\n## Package advisory (CVE-2024-51744)\n\nAffected packages:\n\n- `github.com/golang-jwt/jwt/v4 < 4.5.1`\n\nPatched in:\n\n- `github.com/golang-jwt/jwt/v4 4.5.1`\n\nSource: https://osv.dev/vulnerability/GHSA-29wx-vh33-7x7r","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}