CVE-2025-30204

High

Advisory

Published 21 Mar 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.007; 52nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 580; of 17,781 indexed, latest versions
Container images: 621; deployed by those charts
Fix available: 2 of 3; affected packages

jwt-go allows excessive memory allocation during header parsing

Carried by container images the latest versions of 580 of 17,781 indexed charts deploy, on 621 images.

Affected package	Affected versions	Fixed in	Images
github.com/golang-jwt/jwt/v4golang	v4.0.0, v4.1.0, v4.2.0, v4.3.0+5 more	4.5.2	453
github.com/golang-jwt/jwt/v5golang	v5.0.0, v5.1.0, v5.2.0, v5.2.1	5.2.2	184
github.com/golang-jwt/jwtgolang	v3.2.1+incompatible, v3.2.2+incompatible	no fix listed	127

OSV records: GHSA-mh63-6h87-95cp
Also known as: GO-2025-3553

Charts affected

580 by stars

Chart

Latest

Affected images

Radar Score

open5gsopen5gs

2.3.4

1 of 5 See more

open5gs open5gs 2.3.4

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
gradiant/open5gs-dbctl :0.10.3	332031245fce	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

9,261

mattermostphntom

3.24.0

1 of 2 See more

mattermost phntom 3.24.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
phntom/mattermost-team-edition :9.3.0	51cf9da4aa2e	github.com/golang-jwt/jwt/v5@v5.0.0	5.2.2

Open the chart page →

8,722

uffizzi-appuffizzi-app

1.3.0

1 of 14 See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/jetstack/cert-manager-controller :v1.13.2	9c67cf8c92d8	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

19,337

aperture-controlleraperture

2.34.0

1 of 5 See more

aperture-controller aperture 2.34.0

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.33.5	91100b06e86d	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2

Open the chart page →

4,663

prometheusavesha

19.3.0

2 of 4 See more

prometheus avesha 19.3.0

2 of the 4 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.41.0	1a3e9a878e50	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.7.0	a15ca437f230	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

5,484

yatai-deploymentbentoml

1.1.21

1 of 2 See more

yatai-deployment bentoml 1.1.21

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/bentoml/yatai-deployment :1.1.21	2342cfe8c2a9	github.com/golang-jwt/jwt/v4@v4.4.1	4.5.2

Open the chart page →

1,160

cert-managerchoerodon

1.8.2

3 of 4 See more

cert-manager choerodon 1.8.2

3 of the 4 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/jetstack/cert-manager-cainjector :v1.8.2	c010246124c2	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2
quay.io/jetstack/cert-manager-controller :v1.8.2	a20c44021a5d	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2
quay.io/jetstack/cert-manager-ctl :v1.8.2	81b2d775edad	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2

Open the chart page →

7,775

coder-observabilitycoder-observability

0.7.3

7 of 21 See more

coder-observability coder-observability 0.7.3

7 of the 21 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/agent :v0.40.3	f6cbec9409be	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2
grafana/loki :3.1.0	d947e68a84d9	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.0	4.5.2 5.2.2
grafana/loki-canary :3.1.0	39baf6d67f85	github.com/golang-jwt/jwt/v5@v5.2.0	5.2.2
quay.io/minio/mc :RELEASE.2022-09-16T09-16-47Z	546a8b52d7b0	github.com/golang-jwt/jwt/v4@v4.4.1	4.5.2
quay.io/minio/minio :RELEASE.2022-09-17T00-09-45Z	c3d20bc2ea08	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2
quay.io/prometheus-operator/prometheus-config-reloader :v0.74.0	d55631c7a740	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2
quay.io/prometheus/prometheus :v2.53.1	f20d3127bf28	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

24,700

cosmocosmo-platform

0.20.0

2 of 10 See more

cosmo cosmo-platform 0.20.0

2 of the 10 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/graphqlmetrics :0.33.0	efb69ec3330c	github.com/golang-jwt/jwt/v5@v5.2.0	5.2.2
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

28,839

listmonkdeliveryhero

0.1.12

1 of 1 See more

listmonk deliveryhero 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
listmonk/listmonk :v2.1.0	d2eac77ddfad	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed

Open the chart page →

2,537

coreinstill-ai

0.1.75

2 of 15 See more

core instill-ai 0.1.75

2 of the 15 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
groundnuty/k8s-wait-for :v2.0	c14d7271e401	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2
library/influxdb :2.3.0-alpine	d7f5dd5f70e2	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed

Open the chart page →

30,816

kraken-cikraken-ci

1.7.36

1 of 10 See more

kraken-ci kraken-ci 1.7.36

1 of the 10 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-10-24T18-35-07Z	f9576903f19d	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

7,273

pyroscopekubeblocks

0.2.92

1 of 1 See more

pyroscope kubeblocks 0.2.92

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
apecloud/pyroscope :0.37.2	dbca95a15bc1	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed

Open the chart page →

1,620

kubeservice-lxcfs-webhookkubservice-charts

1.6.0

1 of 6 See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/jetstack/cert-manager-controller :v1.13.1	6b83f55bd99e	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

11,582

karporkusionstack

0.7.6

1 of 3 See more

karpor kusionstack 0.7.6

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/coreos/etcd :v3.5.11	842975891182	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

3,295

vcluster-k8sloft

0.0.0-ci.3

3 of 4 See more

vcluster-k8s loft 0.0.0-ci.3

3 of the 4 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
registry.k8s.io/etcd :3.5.6-0	dd75ec974b0a	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2
registry.k8s.io/kube-apiserver :v1.26.1	99e1ed9fbc8a	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2
registry.k8s.io/kube-controller-manager :v1.26.1	40adecbe3a40	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

5,570

kubecostmesosphere-stable

0.37.5

5 of 9 See more

kubecost mesosphere-stable 0.37.5

5 of the 9 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/grafana :9.4.7	1a359d92f40e	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2
gcr.io/kubecost1/cost-model :prod-1.108.1	852f7923fad3	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2
quay.io/prometheus-operator/prometheus-config-reloader :v0.69.1	7bbe804260f3	github.com/golang-jwt/jwt/v5@v5.0.0	5.2.2
quay.io/prometheus/prometheus :v2.55.0	378f4e037035	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2
quay.io/thanos/thanos :v0.36.1	e542959e1b36	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

17,693

move2kubemove2kube

0.3.15

1 of 1 See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/konveyor/move2kube-ui :latest	ec6ab507c5da	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

3,793

oesopsmx

4.0.32

1 of 25 See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/opsmxpublic/create-secret :v4.0.4	defc3263e0e9	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

107,811

ipfs-clusterparadeum-team

0.0.19

1 of 2 See more

ipfs-cluster paradeum-team 0.0.19

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ipfs/ipfs-cluster :1.0.2	1511f6d57994	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

3,757

permifypermify

0.5.0

1 of 1 See more

permify permify 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/permify/permify :v1.3.5	f0c6f7d7daa6	github.com/golang-jwt/jwt/v4@v4.5.1	4.5.2

Open the chart page →

997

plecopleco

0.24.0

1 of 1 See more

pleco pleco 0.24.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
public.ecr.aws/r3m4q3r9/pleco :0.24.0	651739583336	github.com/golang-jwt/jwt/v5@v5.0.0	5.2.2

Open the chart page →

1,346

corednssoftizy

0.2.0

1 of 1 See more

coredns softizy 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
coredns/coredns :1.10.1	a0ead06651cf	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

1,663

sn-platformstreamnative

1.11.44

3 of 9 See more

sn-platform streamnative 1.11.44

3 of the 9 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2
streamnative/pulsar_vault_init :v1.0.7	31533fa9fab7	github.com/golang-jwt/jwt/v4@v4.3.0	4.5.2
quay.io/prometheus/prometheus :v2.43.0	f5c29683a301	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

15,477

feedbacksystemthm-mni-ii

0.47.1

3 of 10 See more

feedbacksystem thm-mni-ii 0.47.1

3 of the 10 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
bitnamilegacy/minio :2023.12.23-debian-11-r2	5bb0aa825d16	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2
library/docker :20.10.21-dind	3153fa63f546	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2
thmmniii/fbs-runner :v1.27.1	86105349c1a3	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

28,534

argocdtwomartens

0.1.1

1 of 3 See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/argoproj/argocd :v2.8.6	acaf37352569	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.0	no fix listed 4.5.2

Open the chart page →

10,315

vouchvouch

3.2.0

1 of 1 See more

vouch vouch 3.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/vouch/vouch-proxy :0.39	d34e220de3cf	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed

Open the chart page →

1,031

vsphere-cpivsphere-tmm

1.6.0

1 of 1 See more

vsphere-cpi vsphere-tmm 1.6.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.28.0	026f63d9ed42	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

1,344

gethvulcanlink

1.10.23

1 of 1 See more

geth vulcanlink 1.10.23

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.10.23	cce21b423165	github.com/golang-jwt/jwt/v4@v4.3.0	4.5.2

Open the chart page →

2,245

minio-operatorwenerme

4.3.7

1 of 2 See more

minio-operator wenerme 4.3.7

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
minio/operator :v4.3.7	54393e03f3b2	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed

Open the chart page →

6,085

wharf-helmwharf-helm

3.2.6

1 of 5 See more

wharf-helm wharf-helm 3.2.6

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	github.com/golang-jwt/jwt/v4@v4.1.0	4.5.2

Open the chart page →

10,032

agentareaagentarea

0.0.18

1 of 16 See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
oryd/kratos :v1.3.1	fe2428f103a6	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2

Open the chart page →

14,914

clearml-servingallegroai

1.6.2

2 of 9 See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/grafana :9.4.3	76dcf36e7d2a	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2
quay.io/prometheus/prometheus :v2.41.0	1a3e9a878e50	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

17,877

smockerandrcuns

0.0.4

1 of 1 See more

smocker andrcuns 0.0.4

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
andrcuns/smocker :0.18.5	b4a8eb20581a	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed

Open the chart page →

2,173

anteonanteon

2.6.4

3 of 13 See more

anteon anteon 2.6.4

3 of the 13 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
chrislusf/seaweedfs :3.64	634b094b2183	github.com/golang-jwt/jwt/v5@v5.2.0	5.2.2
library/influxdb :2.6.1-alpine	44a366dd7724	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed
prom/prometheus :v2.37.9	8176adea328e	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

22,202

scannerappscode

2026.1.15

1 of 3 See more

scanner appscode 2026.1.15

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
rancher/kine :v0.11.4	12889bbcd1e8	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

5,299

stash-enterpriseappscode

0.42.0

1 of 4 See more

stash-enterprise appscode 0.42.0

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/stashed/stash-enterprise :v0.42.1	759f3850eda9	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

3,620

argocd-backup-s3argocd-backup-s3

0.9.5

1 of 1 See more

argocd-backup-s3 argocd-backup-s3 0.9.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/oguzhan-yilmaz/argocd-backup-s3 :latest	b61c750ade19	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

5,222

kedaarieotech

0.1.0

2 of 3 See more

keda arieotech 0.1.0

2 of the 3 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/kedacore/keda :2.16.0	02348a19aeae	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	no fix listed 4.5.2 5.2.2
ghcr.io/kedacore/keda-metrics-apiserver :2.16.0	73a2ebae4413	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	no fix listed 4.5.2 5.2.2

Open the chart page →

2,276

chirpstackbeeinventor

0.1.10

2 of 5 See more

chirpstack beeinventor 0.1.10

2 of the 5 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
chirpstack/chirpstack-application-server :3.17.6	e0b23dfd24d6	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2
chirpstack/chirpstack-gateway-bridge :3.13.2	ce3f2cdca8a9	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2

Open the chart page →

7,807

helm-dashboardbeluga-cloud

2.4.0

1 of 1 See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard :1.3.3	9ab9a675c405	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2

Open the chart page →

2,898

bucket-backup-restorebucket-backup-restore

0.1.0

1 of 2 See more

bucket-backup-restore bucket-backup-restore 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
abohatyrenko/bucket-backup-restore :latest	fa98af15a13e	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2

Open the chart page →

2,042

finops-stackcert-manager

0.0.5

7 of 12 See more

finops-stack cert-manager 0.0.5

7 of the 12 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.3	b23b588cf7cb	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/background-controller :v1.12.5	06ed5db6cd33	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/cleanup-controller :v1.12.5	b914032ef9ad	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/kyverno :v1.12.5	a61c7022abcf	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/kyverno-cli :v1.12.5	832a32779e6d	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/kyvernopre :v1.12.5	63f7eaf5aa8a	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/reports-controller :v1.12.5	c62e3347611c	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2

Open the chart page →

12,562

cnpg-sandboxcloudnative-pg

0.6.1

1 of 6 See more

cnpg-sandbox cloudnative-pg 0.6.1

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/grafana :8.3.5	cd7cb4345aa7	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2

Open the chart page →

7,583

istio-allcode4devs

1.2.0

1 of 6 See more

istio-all code4devs 1.2.0

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

4,784

cryptlex-enterprisecryptlex

3.21.25

1 of 8 See more

cryptlex-enterprise cryptlex 3.21.25

1 of the 8 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2025-03-12T18-04-18Z	46b3009bf704	github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2

Open the chart page →

2,345

revadcs3org

1.6.1

1 of 1 See more

revad cs3org 1.6.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
cs3org/revad :v1.24.0	e80a4d67b352	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed

Open the chart page →

1,704

dbrepodbrepo

1.13.3

2 of 25 See more

dbrepo dbrepo 1.13.3

2 of the 25 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
bitnamilegacy/prometheus :2.54.1-debian-12-r4	08b1b7cb6a5b	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

52,635

dregsydeliveryhero

0.1.5

1 of 1 See more

dregsy deliveryhero 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
xelalex/dregsy :0.4.3	574054e1c417	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed

Open the chart page →

2,969

trivy-operatordevopstales

2.5.0

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

5,598

Container images carrying it

621 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :11.4.0	d8ea37798ccc	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2	2
grafana/loki :3.1.0	d947e68a84d9	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.0	4.5.2 5.2.2	2
grafana/loki :2.5.0	f9ef133793af	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2	2
grafana/tempo :2.5.0	f0200a9bff6d	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2	2
hashicorp/vault :1.15.2	6b4e5dadf082	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2	2
hashicorp/vault :1.12.1	8de4d5f31b38	github.com/golang-jwt/jwt/v4@v4.3.0	4.5.2	2
lachlanevenson/k8s-kubectl :v1.25.4	af5cea3f2e40	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2	2
library/arangodb :3.11.8	1e75d74954a4	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed	2
library/influxdb :2.6.1-alpine	44a366dd7724	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed	2
lightninglabs/lnd :v0.18.3-beta	f86bbec4dfb3	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2	2
listmonk/listmonk :v2.1.0	d2eac77ddfad	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed	2
minio/operator :v4.3.7	54393e03f3b2	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed	2
openebs/node-disk-operator :2.1.0	6afe2123c457	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2	2
oryd/kratos :v1.0.0	d06fc5845f63	github.com/golang-jwt/jwt/v4@v4.1.0	4.5.2	2
oryd/kratos :v1.3.1	fe2428f103a6	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2	2
oryd/oathkeeper :v0.40.6	e8cb9b79a89c	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2	2
otel/opentelemetry-collector-contrib :0.96.0	7ef2a2ff46b9	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.0	no fix listed 4.5.2 5.2.2	2
otel/opentelemetry-collector-k8s :0.111.0	32b3c8296dcc	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2	2
prom/prometheus :v2.52.0	5c435642ca4d	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2	2
prom/prometheus :v2.37.9	8176adea328e	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2	2
prom/prometheus :v2.48.1	a67e5e402ff5	github.com/golang-jwt/jwt/v5@v5.0.0	5.2.2	2
rancher/kine :v0.11.4	12889bbcd1e8	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2	2
rclone/rclone :1.68	74c51b8817e5	github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2	2
rookout/controller :latest	4451a6f6b8ec	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	2
rookout/data-on-prem :latest	51c0fce64467	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.0	no fix listed 4.5.2	2
rss3/op-batcher :a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8a	dae8a5bdd7a6	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	2
rss3/op-proposer :a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8a	a4059dd32c48	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	2
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2	2
temporalio/server :1.22.4	c0a44c26397b	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.0	no fix listed 4.5.2	2
temporalio/ui :2.16.2	af9c9349708f	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed	2
xelalex/dregsy :0.4.3	574054e1c417	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed	2
gcr.io/knative-releases/knative.dev/serving/cmd/controller	5b93308a392c	github.com/golang-jwt/jwt/v4@v4.5.1	4.5.2	2
ghcr.io/appscode/kube-auth-manager :v0.0.1	789692ab9193	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2	2
ghcr.io/astriaorg/astria-geth :latest	4249e403225a	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	2
ghcr.io/buoyantio/prometheus :v2.55.1	2659f4c2ebb7	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2	2
ghcr.io/dergeberl/kubeteach :v0.2.3-alpha	cf4428a3c79e	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2	2
ghcr.io/opencost/opencost :1.121.2	de2784434527	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	2
ghcr.io/parca-dev/parca :v0.20.0	0d1df8f436f7	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	2
public.ecr.aws/eks-distro/etcd-io/etcd :v3.5.6-eks-1-24-7	efa6dee17ed2	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2	2
quay.io/argoproj/argo-events :v1.9.11	fa07b2c9ece6	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed	2
quay.io/coreos/etcd :v3.5.6	28cb0630cb85	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2	2
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.4.2	no fix listed 4.5.2	2
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	github.com/golang-jwt/jwt/v4@v4.1.0	4.5.2	2
quay.io/jetstack/cert-manager-controller :v1.14.3	64adcb95ce09	github.com/golang-jwt/jwt/v5@v5.0.0	5.2.2	2
quay.io/jetstack/cert-manager-controller :v1.13.2	9c67cf8c92d8	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	2
quay.io/jetstack/cert-manager-controller :v1.11.0	d429b6d696e0	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2	2
quay.io/jetstack/cert-manager-controller :v1.15.3	eee34b3de2dd	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2	2
quay.io/minio/mc :RELEASE.2023-09-29T16-41-22Z	a784ce6e3b1b	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	2
quay.io/minio/mc :RELEASE.2023-01-28T20-29-38Z	ad34abeba912	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2	2
quay.io/minio/minio :RELEASE.2023-09-30T07-02-29Z	6262bc9a2730	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	2