CVE-2025-30204
HighAdvisory
Published 21 Mar 2025In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.007
- 52nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 580
- of 17,781 indexed, latest versions
- Container images
- 621
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
jwt-go allows excessive memory allocation during header parsing
Carried by container images the latest versions of 580 of 17,781 indexed charts deploy, on 621 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v4.0.0, v4.1.0, v4.2.0, v4.3.0+5 more | 4.5.2 | 453 |
| github.com/ | v5.0.0, v5.1.0, v5.2.0, v5.2.1 | 5.2.2 | 184 |
| github.com/ | v3.2.1+incompatible, v3.2.2+incompatible | no fix listed | 127 |
- OSV records
- GHSA-mh63-6h87-95cp
- Also known as
- GO-2025-3553
Charts affected
580 by stars
Container images carrying it
621 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| grafana/ | d8ea37798ccc | github.com/ github.com/ | 4.5.2 5.2.2 | 2 |
| grafana/ | d947e68a84d9 | github.com/ github.com/ | 4.5.2 5.2.2 | 2 |
| grafana/ | f9ef133793af | github.com/ | 4.5.2 | 2 |
| grafana/ | f0200a9bff6d | github.com/ github.com/ | 4.5.2 5.2.2 | 2 |
| hashicorp/ | 6b4e5dadf082 | github.com/ github.com/ | 4.5.2 5.2.2 | 2 |
| hashicorp/ | 8de4d5f31b38 | github.com/ | 4.5.2 | 2 |
| lachlanevenson/ | af5cea3f2e40 | github.com/ | 4.5.2 | 2 |
| library/ | 1e75d74954a4 | github.com/ | no fix listed | 2 |
| library/ | 44a366dd7724 | github.com/ | no fix listed | 2 |
| lightninglabs/ | f86bbec4dfb3 | github.com/ | 4.5.2 | 2 |
| listmonk/ | d2eac77ddfad | github.com/ | no fix listed | 2 |
| minio/ | 54393e03f3b2 | github.com/ | no fix listed | 2 |
| openebs/ | 6afe2123c457 | github.com/ | 4.5.2 | 2 |
| oryd/ | d06fc5845f63 | github.com/ | 4.5.2 | 2 |
| oryd/ | fe2428f103a6 | github.com/ github.com/ | 4.5.2 5.2.2 | 2 |
| oryd/ | e8cb9b79a89c | github.com/ | 4.5.2 | 2 |
| otel/ | 7ef2a2ff46b9 | github.com/ github.com/ github.com/ | no fix listed 4.5.2 5.2.2 | 2 |
| otel/ | 32b3c8296dcc | github.com/ | 5.2.2 | 2 |
| prom/ | 5c435642ca4d | github.com/ | 5.2.2 | 2 |
| prom/ | 8176adea328e | github.com/ | 4.5.2 | 2 |
| prom/ | a67e5e402ff5 | github.com/ | 5.2.2 | 2 |
| rancher/ | 12889bbcd1e8 | github.com/ | 4.5.2 | 2 |
| rclone/ | 74c51b8817e5 | github.com/ github.com/ | 4.5.2 5.2.2 | 2 |
| rookout/ | 4451a6f6b8ec | github.com/ | 4.5.2 | 2 |
| rookout/ | 51c0fce64467 | github.com/ github.com/ | no fix listed 4.5.2 | 2 |
| rss3/ | dae8a5bdd7a6 | github.com/ | 4.5.2 | 2 |
| rss3/ | a4059dd32c48 | github.com/ | 4.5.2 | 2 |
| streamnative/ | 0e6d7aa3ef32 | github.com/ | 4.5.2 | 2 |
| temporalio/ | c0a44c26397b | github.com/ github.com/ | no fix listed 4.5.2 | 2 |
| temporalio/ | af9c9349708f | github.com/ | no fix listed | 2 |
| xelalex/ | 574054e1c417 | github.com/ | no fix listed | 2 |
| gcr.io/ | 5b93308a392c | github.com/ | 4.5.2 | 2 |
| ghcr.io/ | 789692ab9193 | github.com/ | 4.5.2 | 2 |
| ghcr.io/ | 4249e403225a | github.com/ | 4.5.2 | 2 |
| ghcr.io/ | 2659f4c2ebb7 | github.com/ | 5.2.2 | 2 |
| ghcr.io/ | cf4428a3c79e | github.com/ | 4.5.2 | 2 |
| ghcr.io/ | de2784434527 | github.com/ | 4.5.2 | 2 |
| ghcr.io/ | 0d1df8f436f7 | github.com/ | 4.5.2 | 2 |
| public.ecr.aws/ | efa6dee17ed2 | github.com/ | 4.5.2 | 2 |
| quay.io/ | fa07b2c9ece6 | github.com/ | no fix listed | 2 |
| quay.io/ | 28cb0630cb85 | github.com/ | 4.5.2 | 2 |
| quay.io/ | 8c65b333a3d3 | github.com/ github.com/ | no fix listed 4.5.2 | 2 |
| quay.io/ | b736b345437d | github.com/ | 4.5.2 | 2 |
| quay.io/ | 64adcb95ce09 | github.com/ | 5.2.2 | 2 |
| quay.io/ | 9c67cf8c92d8 | github.com/ | 4.5.2 | 2 |
| quay.io/ | d429b6d696e0 | github.com/ | 4.5.2 | 2 |
| quay.io/ | eee34b3de2dd | github.com/ | 5.2.2 | 2 |
| quay.io/ | a784ce6e3b1b | github.com/ | 4.5.2 | 2 |
| quay.io/ | ad34abeba912 | github.com/ | 4.5.2 | 2 |
| quay.io/ | 6262bc9a2730 | github.com/ | 4.5.2 | 2 |