---
id: CVE-2025-30204
aliases:
  - GO-2025-3553
  - GHSA-mh63-6h87-95cp
title: Excessive memory allocation during header parsing in github.com/golang-jwt/jwt
summary: Excessive memory allocation during header parsing in github.com/golang-jwt/jwt
severity: none
vendor: golang-jwt
product: github.com/golang-jwt/jwt
ecosystem: go
affected:
  - github.com/golang-jwt/jwt
  - github.com/golang-jwt/jwt/v4 < 4.5.2
  - 'github.com/golang-jwt/jwt/v5 >= 5.0.0-rc.1, < 5.2.2'
patched:
  - github.com/golang-jwt/jwt/v4 4.5.2
  - github.com/golang-jwt/jwt/v5 5.2.2
published: '2025-03-26'
updated: '2026-08-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2025-3553'
references:
  - url: 'https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp'
  - url: >-
      https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3
tags:
  - osv
  - go
epss: 0.00736
epssPercentile: 0.52505
ingestedAt: '2026-08-08T19:14:55.493Z'
---

## Overview

Excessive memory allocation during header parsing in github.com/golang-jwt/jwt

## Affected packages

- `github.com/golang-jwt/jwt`
- `github.com/golang-jwt/jwt/v4 < 4.5.2`
- `github.com/golang-jwt/jwt/v5 >= 5.0.0-rc.1, < 5.2.2`

## Remediation

Upgrade to a patched release:

- `github.com/golang-jwt/jwt/v4 4.5.2`
- `github.com/golang-jwt/jwt/v5 5.2.2`