StackRadar

CVE-2025-30204

High

Advisory

Published 21 Mar 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
589
of 17,787 indexed, latest versions
Container images
628
deployed by those charts
Fix available
2 of 3
affected packages

jwt-go allows excessive memory allocation during header parsing

Carried by container images the latest versions of 589 of 17,787 indexed charts deploy, on 628 images.

Affected packageAffected versionsFixed inImages
github.com/golang-jwt/jwt/v4golangv4.0.0, v4.1.0, v4.2.0, v4.3.0+5 more4.5.2458
github.com/golang-jwt/jwt/v5golangv5.0.0, v5.1.0, v5.2.0, v5.2.15.2.2184
github.com/golang-jwt/jwtgolangv3.2.1+incompatible, v3.2.2+incompatibleno fix listed131
OSV records
GHSA-mh63-6h87-95cp
Also known as
GO-2025-3553

Charts affected

589 by stars
ChartLatestAffected imagesRadar Score
open5gsopen5gsVerified publisher2.3.41 of 5See more

open5gs open5gs 2.3.4

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
gradiant/open5gs-dbctl:0.10.3332031245fce
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

9,300
mattermostphntom3.24.01 of 2See more

mattermost phntom 3.24.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2

Open the chart page →

8,767
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.13.29c67cf8c92d8
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

19,363
aperture-controlleraperture2.34.01 of 5See more

aperture-controller aperture 2.34.0

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.33.591100b06e86d
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

4,663
prometheusaveshaVerified publisher19.3.02 of 4See more

prometheus avesha 19.3.0

2 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.41.01a3e9a878e50
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.7.0a15ca437f230
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

5,484
yatai-deploymentbentomlVerified publisher1.1.211 of 2See more

yatai-deployment bentoml 1.1.21

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/bentoml/yatai-deployment:1.1.212342cfe8c2a9
github.com/golang-jwt/jwt/v4@v4.4.1
4.5.2

Open the chart page →

1,160
cert-managerchoerodon1.8.23 of 4See more

cert-manager choerodon 1.8.2

3 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-cainjector:v1.8.2c010246124c2
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
quay.io/jetstack/cert-manager-controller:v1.8.2a20c44021a5d
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
quay.io/jetstack/cert-manager-ctl:v1.8.281b2d775edad
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

7,775
coder-observabilitycoder-observabilityVerified publisher0.7.37 of 21See more

coder-observability coder-observability 0.7.3

7 of the 21 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/agent:v0.40.3f6cbec9409be
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
grafana/loki:3.1.0d947e68a84d9
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.0
4.5.2
5.2.2
grafana/loki-canary:3.1.039baf6d67f85
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
quay.io/minio/mc:RELEASE.2022-09-16T09-16-47Z546a8b52d7b0
github.com/golang-jwt/jwt/v4@v4.4.1
4.5.2
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
quay.io/prometheus-operator/prometheus-config-reloader:v0.74.0d55631c7a740
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

24,698
cosmocosmo-platformOfficialVerified publisher0.20.02 of 10See more

cosmo cosmo-platform 0.20.0

2 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/graphqlmetrics:0.33.0efb69ec3330c
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

27,984
listmonkdeliveryheroVerified publisher0.1.121 of 1See more

listmonk deliveryhero 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
listmonk/listmonk:v2.1.0d2eac77ddfad
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

2,537
coreinstill-aiOfficialVerified publisher0.1.752 of 15See more

core instill-ai 0.1.75

2 of the 15 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
groundnuty/k8s-wait-for:v2.0c14d7271e401
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
library/influxdb:2.3.0-alpined7f5dd5f70e2
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

30,920
kraken-cikraken-ciVerified publisher1.7.361 of 10See more

kraken-ci kraken-ci 1.7.36

1 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-10-24T18-35-07Zf9576903f19d
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

7,285
pyroscopekubeblocksVerified publisher0.2.921 of 1See more

pyroscope kubeblocks 0.2.92

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
apecloud/pyroscope:0.37.2dbca95a15bc1
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

1,620
kubeservice-lxcfs-webhookkubservice-chartsVerified publisher1.6.01 of 6See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.13.16b83f55bd99e
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

11,630
karporkusionstackVerified publisher0.7.61 of 3See more

karpor kusionstack 0.7.6

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/coreos/etcd:v3.5.11842975891182
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

3,297
vcluster-k8sloftVerified publisher0.0.0-ci.33 of 4See more

vcluster-k8s loft 0.0.0-ci.3

3 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
registry.k8s.io/etcd:3.5.6-0dd75ec974b0a
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
registry.k8s.io/kube-apiserver:v1.26.199e1ed9fbc8a
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
registry.k8s.io/kube-controller-manager:v1.26.140adecbe3a40
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

5,574
kubecostmesosphere-stable0.37.55 of 9See more

kubecost mesosphere-stable 0.37.5

5 of the 9 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:9.4.71a359d92f40e
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
gcr.io/kubecost1/cost-model:prod-1.108.1852f7923fad3
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
quay.io/prometheus-operator/prometheus-config-reloader:v0.69.17bbe804260f3
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2
quay.io/prometheus/prometheus:v2.55.0378f4e037035
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
quay.io/thanos/thanos:v0.36.1e542959e1b36
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

17,755
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

3,794
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/create-secret:v4.0.4defc3263e0e9
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

107,899
ipfs-clusterparadeum-teamVerified publisher0.0.191 of 2See more

ipfs-cluster paradeum-team 0.0.19

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ipfs/ipfs-cluster:1.0.21511f6d57994
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

3,757
permifypermifyVerified publisher0.5.01 of 1See more

permify permify 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
github.com/golang-jwt/jwt/v4@v4.5.1
4.5.2

Open the chart page →

997
plecopleco0.24.01 of 1See more

pleco pleco 0.24.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2

Open the chart page →

1,346
corednssoftizyVerified publisher0.2.01 of 1See more

coredns softizy 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
coredns/coredns:1.10.1a0ead06651cf
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

1,663
sn-platformstreamnative1.11.443 of 9See more

sn-platform streamnative 1.11.44

3 of the 9 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
streamnative/pulsar_vault_init:v1.0.731533fa9fab7
github.com/golang-jwt/jwt/v4@v4.3.0
4.5.2
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

15,525
feedbacksystemthm-mni-iiVerified publisher0.47.13 of 10See more

feedbacksystem thm-mni-ii 0.47.1

3 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2023.12.23-debian-11-r25bb0aa825d16
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
library/docker:20.10.21-dind3153fa63f546
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
thmmniii/fbs-runner:v1.27.186105349c1a3
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

28,579
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2

Open the chart page →

10,355
vouchvouchVerified publisher3.2.01 of 1See more

vouch vouch 3.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/vouch/vouch-proxy:0.39d34e220de3cf
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

1,031
vsphere-cpivsphere-tmm1.6.01 of 1See more

vsphere-cpi vsphere-tmm 1.6.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.28.0026f63d9ed42
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

1,344
gethvulcanlink1.10.231 of 1See more

geth vulcanlink 1.10.23

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ethereum/client-go:v1.10.23cce21b423165
github.com/golang-jwt/jwt/v4@v4.3.0
4.5.2

Open the chart page →

2,245
minio-operatorwenerme4.3.71 of 2See more

minio-operator wenerme 4.3.7

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
minio/operator:v4.3.754393e03f3b2
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

6,085
wharf-helmwharf-helmOfficialVerified publisher3.2.61 of 5See more

wharf-helm wharf-helm 3.2.6

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/iver-wharf/wharf-api:v5.2.0b736b345437d
github.com/golang-jwt/jwt/v4@v4.1.0
4.5.2

Open the chart page →

10,033
agentareaagentareaVerified publisher0.0.181 of 16See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
oryd/kratos:v1.3.1fe2428f103a6
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

14,960
clearml-servingallegroaiVerified publisher1.6.22 of 9See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:9.4.376dcf36e7d2a
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
quay.io/prometheus/prometheus:v2.41.01a3e9a878e50
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

17,879
smockerandrcunsVerified publisher0.0.41 of 1See more

smocker andrcuns 0.0.4

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
andrcuns/smocker:0.18.5b4a8eb20581a
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

2,173
anteonanteonVerified publisher2.6.43 of 13See more

anteon anteon 2.6.4

3 of the 13 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
chrislusf/seaweedfs:3.64634b094b2183
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
library/influxdb:2.6.1-alpine44a366dd7724
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed
prom/prometheus:v2.37.98176adea328e
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

22,233
scannerappscodeVerified publisher2026.1.151 of 3See more

scanner appscode 2026.1.15

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
rancher/kine:v0.11.412889bbcd1e8
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

5,301
stash-enterpriseappscodeVerified publisher0.42.01 of 4See more

stash-enterprise appscode 0.42.0

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/stashed/stash-enterprise:v0.42.1759f3850eda9
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

3,620
argocd-backup-s3argocd-backup-s3Verified publisher0.9.51 of 1See more

argocd-backup-s3 argocd-backup-s3 0.9.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/argocd-backup-s3:latestb61c750ade19
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

5,231
kedaarieotechVerified publisher0.1.02 of 3See more

keda arieotech 0.1.0

2 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.16.002348a19aeae
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
no fix listed
4.5.2
5.2.2
ghcr.io/kedacore/keda-metrics-apiserver:2.16.073a2ebae4413
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
no fix listed
4.5.2
5.2.2

Open the chart page →

2,276
chirpstackbeeinventor0.1.102 of 5See more

chirpstack beeinventor 0.1.10

2 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
chirpstack/chirpstack-application-server:3.17.6e0b23dfd24d6
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
chirpstack/chirpstack-gateway-bridge:3.13.2ce3f2cdca8a9
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

7,807
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2

Open the chart page →

2,900
bucket-backup-restorebucket-backup-restore0.1.01 of 2See more

bucket-backup-restore bucket-backup-restore 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
abohatyrenko/bucket-backup-restore:latestfa98af15a13e
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2

Open the chart page →

2,042
finops-stackcert-managerVerified publisher0.0.57 of 12See more

finops-stack cert-manager 0.0.5

7 of the 12 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:11.1.3b23b588cf7cb
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

12,561
cnpg-sandboxcloudnative-pgVerified publisher0.6.11 of 6See more

cnpg-sandbox cloudnative-pg 0.6.1

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:8.3.5cd7cb4345aa7
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

7,583
istio-allcode4devsVerified publisher1.2.01 of 6See more

istio-all code4devs 1.2.0

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.54.1f6639335d34a
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

4,784
cryptlex-enterprisecryptlex3.21.251 of 8See more

cryptlex-enterprise cryptlex 3.21.25

1 of the 8 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2025-03-12T18-04-18Z46b3009bf704
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

2,345
revadcs3orgOfficialVerified publisher1.6.11 of 1See more

revad cs3org 1.6.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
cs3org/revad:v1.24.0e80a4d67b352
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

1,704
dbrepodbrepo1.13.32 of 25See more

dbrepo dbrepo 1.13.3

2 of the 25 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
bitnamilegacy/prometheus:2.54.1-debian-12-r408b1b7cb6a5b
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

50,281
dregsydeliveryheroVerified publisher0.1.51 of 1See more

dregsy deliveryhero 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
xelalex/dregsy:0.4.3574054e1c417
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

2,969
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

5,599

Container images carrying it

628 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/minio/minio:RELEASE.2024-06-04T19-20-08Zc6b68f158628
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
quay.io/minio/minio:RELEASE.2022-10-24T18-35-07Zd853057f2800
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
1
quay.io/oauth2-proxy/oauth2-proxy:v7.7.09ed7eaf72050
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/oauth2-proxy/oauth2-proxy:v7.2.1febeebebe762
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed
1
quay.io/ongres/kubectl:v1.25.16-build-6.5304dada9e4503
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
quay.io/opsmxpublic/create-secret:v4.0.4defc3263e0e9
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/prometheus-operator/prometheus-config-reloader:v0.73.2706cde441321
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1
quay.io/prometheus-operator/prometheus-config-reloader:v0.69.17bbe804260f3
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2
1
quay.io/prometheus-operator/prometheus-operator:v0.73.204f2b98d71ef
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1
quay.io/prometheus-operator/prometheus-operator:v0.74.06b3f6d8b4c0a
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/prometheus/prometheus:v3.0.03b9b2a15d376
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/prometheus/prometheus:v2.39.14748e26f9369
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/prometheus/prometheus:v3.2.05888c188cf09
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/prometheus/prometheus:v3.2.16927e0919a14
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/prometheus/prometheus:v2.33.591100b06e86d
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
quay.io/prometheus/prometheus:v2.34.0b37103e03399
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
quay.io/thanos/thanos:v0.36.1e542959e1b36
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
quay.io/vouch/vouch-proxy:0.39d34e220de3cf
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed
1
registry.gitlab.com/lenitech/k8s-operator/keycloak-client:v0.6.19065cdd80035
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2
1
registry.k8s.io/autoscaling/cluster-autoscaler:v1.33.06ef10d108e0e
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.28.0026f63d9ed42
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.32.0f9f4dfd733ab
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
registry.k8s.io/kube-apiserver:v1.25.0f6902791fb9a
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
registry.k8s.io/kube-controller-manager:v1.25.066ce7d460e53
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.