StackRadar

CVE-2025-30204

High

Advisory

Published 21 Mar 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
589
of 17,787 indexed, latest versions
Container images
628
deployed by those charts
Fix available
2 of 3
affected packages

jwt-go allows excessive memory allocation during header parsing

Carried by container images the latest versions of 589 of 17,787 indexed charts deploy, on 628 images.

Affected packageAffected versionsFixed inImages
github.com/golang-jwt/jwt/v4golangv4.0.0, v4.1.0, v4.2.0, v4.3.0+5 more4.5.2458
github.com/golang-jwt/jwt/v5golangv5.0.0, v5.1.0, v5.2.0, v5.2.15.2.2184
github.com/golang-jwt/jwtgolangv3.2.1+incompatible, v3.2.2+incompatibleno fix listed131
OSV records
GHSA-mh63-6h87-95cp
Also known as
GO-2025-3553

Charts affected

589 by stars
ChartLatestAffected imagesRadar Score
orchestratorsubstraVerified publisher8.8.01 of 3See more

orchestrator substra 8.8.0

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/substra/orchestrator-server:1.0.0647e45284a80
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

3,003
lingosubstratusVerified publisher0.2.11 of 1See more

lingo substratus 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/substratusai/lingo:v0.2.12c807cd41ed4
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

1,474
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v5@v5.2.0
no fix listed
5.2.2

Open the chart page →

3,372
grafanasvtech-public-helm-charts1.0.01 of 2See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2

Open the chart page →

10,949
agentssynapse0.1.301 of 9See more

agents synapse 0.1.30

1 of the 9 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/agents:6e3887fc2a05aff0d159453cedbfbe5024b910bf81a9ebc899a4
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2

Open the chart page →

7,244
cctpsynapse0.3.01 of 4See more

cctp synapse 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/cctp-relayer:b5a1dd5288f1a18eb05994e130d626fed45a56fc2f1408c94168
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2

Open the chart page →

1,815
promexportersynapse0.1.11 of 1See more

promexporter synapse 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/promexporter:4a9aad096c2bd1160e56e5472ddac77fa0cde2e9416c1c5aeb86
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2

Open the chart page →

1,704
pingmetektonops0.1.21 of 1See more

pingme tektonops 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
khaliq/pingme:v0.2.749f96888d2ab
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

1,253
temporaltemporal0.28.94 of 13See more

temporal temporal 0.28.9

4 of the 13 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.22.0836af062af30
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.4.3
no fix listed
4.5.2
temporalio/server:1.22.0ddeebf8bad8f
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2
temporalio/ui:2.16.2af9c9349708f
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed
quay.io/prometheus/prometheus:v2.31.1a8779cfe553e
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

21,004
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

10,065
monitoringthl-chartsVerified publisher0.1.14 of 10See more

monitoring thl-charts 0.1.1

4 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:8.5.042d3e6bc1865
github.com/golang-jwt/jwt@v3.2.1+incompatible
github.com/golang-jwt/jwt/v4@v4.2.0
no fix listed
4.5.2
grafana/loki:2.5.0f9ef133793af
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
grafana/promtail:2.4.2626900031c4e
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
quay.io/prometheus/prometheus:v2.34.0b37103e03399
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

18,908
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
erenozcan17/go_backend:v4.250b4f23422b6
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2

Open the chart page →

6,974
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

2,478
posteetrivy-operator2.14.02 of 3See more

postee trivy-operator 2.14.0

2 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
aquasec/postee:2.12.0-amd640795cba777e7
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
aquasec/postee-ui:2.12.0-amd64c0467c3941dc
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

4,815
tfy-lokitruefoundryVerified publisher0.1.62 of 2See more

tfy-loki truefoundry 0.1.6

2 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/loki:2.9.1035b02acc6765
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
grafana/promtail:2.9.1063a2e57a5b14
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

2,813
tyk-bootstraptyk-helm5.3.01 of 3See more

tyk-bootstrap tyk-helm 5.3.0

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
tykio/tyk-k8s-bootstrap-pre-install:v2.2.0205215b815a4
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

1,374
tyk-control-planetyk-helm5.3.01 of 7See more

tyk-control-plane tyk-helm 5.3.0

1 of the 7 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
tykio/tyk-k8s-bootstrap-pre-install:v2.2.0205215b815a4
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

2,929
tyk-stacktyk-helm5.3.01 of 7See more

tyk-stack tyk-helm 5.3.0

1 of the 7 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
tykio/tyk-k8s-bootstrap-pre-install:v2.2.0205215b815a4
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

2,879
typhoontyphoonVerified publisher0.2.31 of 2See more

typhoon typhoon 0.2.3

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/zeiss/typhoon/controller:0.2.34fdf4edfda45
github.com/golang-jwt/jwt/v4@v4.5.1
4.5.2

Open the chart page →

1,672
miniouninettsigma21.2.01 of 1See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

4,960
scrutinyvhdirkVerified publisher0.1.31 of 1See more

scrutiny vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/analogj/scrutiny:master-omnibus18689773150d
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

4,394
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

13,563
gateway-control-planewallarmVerified publisher0.2.01 of 2See more

gateway-control-plane wallarm 0.2.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
wallarm/gateway-control-plane:0.2.0a321bc974a19
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2

Open the chart page →

1,455
wallarm-node-nextwallarmVerified publisher0.5.31 of 2See more

wallarm-node-next wallarm 0.5.3

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
wallarm/node-helpers:5.0.2-1097cadc42336
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

2,408
consulwarjiang1.3.01 of 2See more

consul warjiang 1.3.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
hashicorp/consul:1.17.0712fe02d2f84
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

4,059
eth-validatorwateim1.4.51 of 3See more

eth-validator wateim 1.4.5

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
wateim/lighthouse-launch:latest2520149ee574
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

5,077
azure-janitorwebdevopsVerified publisher1.0.131 of 1See more

azure-janitor webdevops 1.0.13

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
webdevops/azure-janitor:24.9.02446baee7b69
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

801
azure-keyvault-exporterwebdevopsVerified publisher1.0.121 of 1See more

azure-keyvault-exporter webdevops 1.0.12

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
webdevops/azure-keyvault-exporter:24.9.1f333704ecd60
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

801
azure-resourcegraph-exporterwebdevopsVerified publisher1.1.51 of 1See more

azure-resourcegraph-exporter webdevops 1.1.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
webdevops/azure-resourcegraph-exporter:24.9.0381136dda026
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

785
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

969
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.1.0
no fix listed
4.5.2

Open the chart page →

6,138
openebswenerme3.10.01 of 3See more

openebs wenerme 3.10.0

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
openebs/node-disk-operator:2.1.06afe2123c457
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

10,568
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
temporalio/server:1.15.1e26758f5a1bf
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

22,665
wexa-studiowexa-studio1.2.02 of 15See more

wexa-studio wexa-studio 1.2.0

2 of the 15 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
minio/minio:RELEASE.2024-01-16T16-07-38Z4c4a4876193f
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

14,618
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2

Open the chart page →

2,022
kafka-connect-uiwitcom-gmbh0.5.01 of 2See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.3.08c21390be87d
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

2,506
mrtg-backendwitcom-gmbh0.7.01 of 2See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.2.1febeebebe762
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

2,616
owlxdVerified publisher0.5.12 of 2See more

owl xd 0.5.1

2 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
lishimeng/owl-console:v0.11.2c79a67657baf
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
lishimeng/owl-messager:v0.11.23d00485e64dc
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2

Open the chart page →

3,880
ygdrassil-monitoringygdrassilVerified publisher0.4.02 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

9,381

Container images carrying it

628 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/minio/minio:RELEASE.2024-06-04T19-20-08Zc6b68f158628
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
quay.io/minio/minio:RELEASE.2022-10-24T18-35-07Zd853057f2800
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
1
quay.io/oauth2-proxy/oauth2-proxy:v7.7.09ed7eaf72050
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/oauth2-proxy/oauth2-proxy:v7.2.1febeebebe762
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed
1
quay.io/ongres/kubectl:v1.25.16-build-6.5304dada9e4503
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
quay.io/opsmxpublic/create-secret:v4.0.4defc3263e0e9
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/prometheus-operator/prometheus-config-reloader:v0.73.2706cde441321
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1
quay.io/prometheus-operator/prometheus-config-reloader:v0.69.17bbe804260f3
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2
1
quay.io/prometheus-operator/prometheus-operator:v0.73.204f2b98d71ef
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1
quay.io/prometheus-operator/prometheus-operator:v0.74.06b3f6d8b4c0a
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/prometheus/prometheus:v3.0.03b9b2a15d376
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/prometheus/prometheus:v2.39.14748e26f9369
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/prometheus/prometheus:v3.2.05888c188cf09
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/prometheus/prometheus:v3.2.16927e0919a14
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/prometheus/prometheus:v2.33.591100b06e86d
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
quay.io/prometheus/prometheus:v2.34.0b37103e03399
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
quay.io/thanos/thanos:v0.36.1e542959e1b36
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/vouch/vouch-proxy:0.39d34e220de3cf
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed
1
registry.gitlab.com/lenitech/k8s-operator/keycloak-client:v0.6.19065cdd80035
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2
1
registry.k8s.io/autoscaling/cluster-autoscaler:v1.33.06ef10d108e0e
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.28.0026f63d9ed42
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.32.0f9f4dfd733ab
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
registry.k8s.io/kube-apiserver:v1.25.0f6902791fb9a
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
registry.k8s.io/kube-controller-manager:v1.25.066ce7d460e53
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.