{"id":"CVE-2025-30204","aliases":["GO-2025-3553","GHSA-mh63-6h87-95cp"],"title":"Excessive memory allocation during header parsing in github.com/golang-jwt/jwt","summary":"Excessive memory allocation during header parsing in github.com/golang-jwt/jwt","severity":"none","vendor":"golang-jwt","product":"github.com/golang-jwt/jwt","ecosystem":"go","affected":["github.com/golang-jwt/jwt","github.com/golang-jwt/jwt/v4 < 4.5.2","github.com/golang-jwt/jwt/v5 >= 5.0.0-rc.1, < 5.2.2"],"patched":["github.com/golang-jwt/jwt/v4 4.5.2","github.com/golang-jwt/jwt/v5 5.2.2"],"published":"2025-03-26","updated":"2026-08-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2025-3553","references":[{"url":"https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp"},{"url":"https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3"}],"tags":["osv","go"],"epss":0.00736,"epssPercentile":0.5303,"ingestedAt":"2026-08-08T19:14:55.493Z","slug":"CVE-2025-30204","body":"## Overview\n\nExcessive memory allocation during header parsing in github.com/golang-jwt/jwt\n\n## Affected packages\n\n- `github.com/golang-jwt/jwt`\n- `github.com/golang-jwt/jwt/v4 < 4.5.2`\n- `github.com/golang-jwt/jwt/v5 >= 5.0.0-rc.1, < 5.2.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/golang-jwt/jwt/v4 4.5.2`\n- `github.com/golang-jwt/jwt/v5 5.2.2`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}