StackRadar

CVE-2025-30204

High

Advisory

Published 21 Mar 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
580
of 17,781 indexed, latest versions
Container images
621
deployed by those charts
Fix available
2 of 3
affected packages

jwt-go allows excessive memory allocation during header parsing

Carried by container images the latest versions of 580 of 17,781 indexed charts deploy, on 621 images.

Affected packageAffected versionsFixed inImages
github.com/golang-jwt/jwt/v4golangv4.0.0, v4.1.0, v4.2.0, v4.3.0+5 more4.5.2453
github.com/golang-jwt/jwt/v5golangv5.0.0, v5.1.0, v5.2.0, v5.2.15.2.2184
github.com/golang-jwt/jwtgolangv3.2.1+incompatible, v3.2.2+incompatibleno fix listed127
OSV records
GHSA-mh63-6h87-95cp
Also known as
GO-2025-3553

Charts affected

580 by stars
ChartLatestAffected imagesRadar Score
open5gsopen5gsVerified publisher2.3.41 of 5See more

open5gs open5gs 2.3.4

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
gradiant/open5gs-dbctl:0.10.3332031245fce
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

9,261
mattermostphntom3.24.01 of 2See more

mattermost phntom 3.24.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2

Open the chart page →

8,722
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.13.29c67cf8c92d8
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

19,337
aperture-controlleraperture2.34.01 of 5See more

aperture-controller aperture 2.34.0

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.33.591100b06e86d
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

4,663
prometheusaveshaVerified publisher19.3.02 of 4See more

prometheus avesha 19.3.0

2 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.41.01a3e9a878e50
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.7.0a15ca437f230
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

5,484
yatai-deploymentbentomlVerified publisher1.1.211 of 2See more

yatai-deployment bentoml 1.1.21

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/bentoml/yatai-deployment:1.1.212342cfe8c2a9
github.com/golang-jwt/jwt/v4@v4.4.1
4.5.2

Open the chart page →

1,160
cert-managerchoerodon1.8.23 of 4See more

cert-manager choerodon 1.8.2

3 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-cainjector:v1.8.2c010246124c2
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
quay.io/jetstack/cert-manager-controller:v1.8.2a20c44021a5d
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
quay.io/jetstack/cert-manager-ctl:v1.8.281b2d775edad
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

7,775
coder-observabilitycoder-observabilityVerified publisher0.7.37 of 21See more

coder-observability coder-observability 0.7.3

7 of the 21 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/agent:v0.40.3f6cbec9409be
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
grafana/loki:3.1.0d947e68a84d9
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.0
4.5.2
5.2.2
grafana/loki-canary:3.1.039baf6d67f85
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
quay.io/minio/mc:RELEASE.2022-09-16T09-16-47Z546a8b52d7b0
github.com/golang-jwt/jwt/v4@v4.4.1
4.5.2
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
quay.io/prometheus-operator/prometheus-config-reloader:v0.74.0d55631c7a740
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

24,700
cosmocosmo-platformOfficialVerified publisher0.20.02 of 10See more

cosmo cosmo-platform 0.20.0

2 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/graphqlmetrics:0.33.0efb69ec3330c
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

28,839
listmonkdeliveryheroVerified publisher0.1.121 of 1See more

listmonk deliveryhero 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
listmonk/listmonk:v2.1.0d2eac77ddfad
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

2,537
coreinstill-aiOfficialVerified publisher0.1.752 of 15See more

core instill-ai 0.1.75

2 of the 15 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
groundnuty/k8s-wait-for:v2.0c14d7271e401
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
library/influxdb:2.3.0-alpined7f5dd5f70e2
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

30,816
kraken-cikraken-ciVerified publisher1.7.361 of 10See more

kraken-ci kraken-ci 1.7.36

1 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-10-24T18-35-07Zf9576903f19d
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

7,273
pyroscopekubeblocksVerified publisher0.2.921 of 1See more

pyroscope kubeblocks 0.2.92

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
apecloud/pyroscope:0.37.2dbca95a15bc1
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

1,620
kubeservice-lxcfs-webhookkubservice-chartsVerified publisher1.6.01 of 6See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.13.16b83f55bd99e
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

11,582
karporkusionstackVerified publisher0.7.61 of 3See more

karpor kusionstack 0.7.6

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/coreos/etcd:v3.5.11842975891182
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

3,295
vcluster-k8sloftVerified publisher0.0.0-ci.33 of 4See more

vcluster-k8s loft 0.0.0-ci.3

3 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
registry.k8s.io/etcd:3.5.6-0dd75ec974b0a
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
registry.k8s.io/kube-apiserver:v1.26.199e1ed9fbc8a
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
registry.k8s.io/kube-controller-manager:v1.26.140adecbe3a40
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

5,570
kubecostmesosphere-stable0.37.55 of 9See more

kubecost mesosphere-stable 0.37.5

5 of the 9 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:9.4.71a359d92f40e
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
gcr.io/kubecost1/cost-model:prod-1.108.1852f7923fad3
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
quay.io/prometheus-operator/prometheus-config-reloader:v0.69.17bbe804260f3
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2
quay.io/prometheus/prometheus:v2.55.0378f4e037035
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
quay.io/thanos/thanos:v0.36.1e542959e1b36
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

17,693
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

3,793
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/create-secret:v4.0.4defc3263e0e9
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

107,811
ipfs-clusterparadeum-teamVerified publisher0.0.191 of 2See more

ipfs-cluster paradeum-team 0.0.19

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ipfs/ipfs-cluster:1.0.21511f6d57994
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

3,757
permifypermifyVerified publisher0.5.01 of 1See more

permify permify 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
github.com/golang-jwt/jwt/v4@v4.5.1
4.5.2

Open the chart page →

997
plecopleco0.24.01 of 1See more

pleco pleco 0.24.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2

Open the chart page →

1,346
corednssoftizyVerified publisher0.2.01 of 1See more

coredns softizy 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
coredns/coredns:1.10.1a0ead06651cf
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

1,663
sn-platformstreamnative1.11.443 of 9See more

sn-platform streamnative 1.11.44

3 of the 9 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
streamnative/pulsar_vault_init:v1.0.731533fa9fab7
github.com/golang-jwt/jwt/v4@v4.3.0
4.5.2
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

15,477
feedbacksystemthm-mni-iiVerified publisher0.47.13 of 10See more

feedbacksystem thm-mni-ii 0.47.1

3 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2023.12.23-debian-11-r25bb0aa825d16
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
library/docker:20.10.21-dind3153fa63f546
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
thmmniii/fbs-runner:v1.27.186105349c1a3
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

28,534
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2

Open the chart page →

10,315
vouchvouchVerified publisher3.2.01 of 1See more

vouch vouch 3.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/vouch/vouch-proxy:0.39d34e220de3cf
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

1,031
vsphere-cpivsphere-tmm1.6.01 of 1See more

vsphere-cpi vsphere-tmm 1.6.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.28.0026f63d9ed42
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

1,344
gethvulcanlink1.10.231 of 1See more

geth vulcanlink 1.10.23

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ethereum/client-go:v1.10.23cce21b423165
github.com/golang-jwt/jwt/v4@v4.3.0
4.5.2

Open the chart page →

2,245
minio-operatorwenerme4.3.71 of 2See more

minio-operator wenerme 4.3.7

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
minio/operator:v4.3.754393e03f3b2
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

6,085
wharf-helmwharf-helmOfficialVerified publisher3.2.61 of 5See more

wharf-helm wharf-helm 3.2.6

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/iver-wharf/wharf-api:v5.2.0b736b345437d
github.com/golang-jwt/jwt/v4@v4.1.0
4.5.2

Open the chart page →

10,032
agentareaagentareaVerified publisher0.0.181 of 16See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
oryd/kratos:v1.3.1fe2428f103a6
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

14,914
clearml-servingallegroaiVerified publisher1.6.22 of 9See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:9.4.376dcf36e7d2a
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
quay.io/prometheus/prometheus:v2.41.01a3e9a878e50
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

17,877
smockerandrcunsVerified publisher0.0.41 of 1See more

smocker andrcuns 0.0.4

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
andrcuns/smocker:0.18.5b4a8eb20581a
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

2,173
anteonanteonVerified publisher2.6.43 of 13See more

anteon anteon 2.6.4

3 of the 13 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
chrislusf/seaweedfs:3.64634b094b2183
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
library/influxdb:2.6.1-alpine44a366dd7724
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed
prom/prometheus:v2.37.98176adea328e
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

22,202
scannerappscodeVerified publisher2026.1.151 of 3See more

scanner appscode 2026.1.15

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
rancher/kine:v0.11.412889bbcd1e8
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

5,299
stash-enterpriseappscodeVerified publisher0.42.01 of 4See more

stash-enterprise appscode 0.42.0

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/stashed/stash-enterprise:v0.42.1759f3850eda9
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

3,620
argocd-backup-s3argocd-backup-s3Verified publisher0.9.51 of 1See more

argocd-backup-s3 argocd-backup-s3 0.9.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/argocd-backup-s3:latestb61c750ade19
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

5,222
kedaarieotechVerified publisher0.1.02 of 3See more

keda arieotech 0.1.0

2 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.16.002348a19aeae
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
no fix listed
4.5.2
5.2.2
ghcr.io/kedacore/keda-metrics-apiserver:2.16.073a2ebae4413
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
no fix listed
4.5.2
5.2.2

Open the chart page →

2,276
chirpstackbeeinventor0.1.102 of 5See more

chirpstack beeinventor 0.1.10

2 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
chirpstack/chirpstack-application-server:3.17.6e0b23dfd24d6
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
chirpstack/chirpstack-gateway-bridge:3.13.2ce3f2cdca8a9
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

7,807
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2

Open the chart page →

2,898
bucket-backup-restorebucket-backup-restore0.1.01 of 2See more

bucket-backup-restore bucket-backup-restore 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
abohatyrenko/bucket-backup-restore:latestfa98af15a13e
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2

Open the chart page →

2,042
finops-stackcert-managerVerified publisher0.0.57 of 12See more

finops-stack cert-manager 0.0.5

7 of the 12 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:11.1.3b23b588cf7cb
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

12,562
cnpg-sandboxcloudnative-pgVerified publisher0.6.11 of 6See more

cnpg-sandbox cloudnative-pg 0.6.1

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:8.3.5cd7cb4345aa7
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

7,583
istio-allcode4devsVerified publisher1.2.01 of 6See more

istio-all code4devs 1.2.0

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.54.1f6639335d34a
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

4,784
cryptlex-enterprisecryptlex3.21.251 of 8See more

cryptlex-enterprise cryptlex 3.21.25

1 of the 8 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2025-03-12T18-04-18Z46b3009bf704
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

2,345
revadcs3orgOfficialVerified publisher1.6.11 of 1See more

revad cs3org 1.6.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
cs3org/revad:v1.24.0e80a4d67b352
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

1,704
dbrepodbrepo1.13.32 of 25See more

dbrepo dbrepo 1.13.3

2 of the 25 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
bitnamilegacy/prometheus:2.54.1-debian-12-r408b1b7cb6a5b
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

52,635
dregsydeliveryheroVerified publisher0.1.51 of 1See more

dregsy deliveryhero 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
xelalex/dregsy:0.4.3574054e1c417
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

2,969
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

5,598

Container images carrying it

621 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
galaxy/cloudman-server:lateste5c265fe9fcd
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
gitea/gitea:1.22.376f516a1a8c2
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
gitea/gitea:1.21.6ac73e0da341f
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
1
goalert/goalert:v0.32.008d57388b0cb
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1
gobitfly/eth2-beaconchain-explorer:latest1d08a7986348
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.1
no fix listed
4.5.2
1
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.2.0
no fix listed
4.5.2
1
goharbor/harbor-acceld:0.2.13451103a6c8d8
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed
1
goharbor/harbor-core:v2.9.06412d679fdc3
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
1
goharbor/harbor-core:v2.5.386bf3031f4a7
github.com/golang-jwt/jwt/v4@v4.1.0
4.5.2
1
goharbor/harbor-core:v2.11.1c017dd84ee96
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
github.com/golang-jwt/jwt/v4@v4.1.0
4.5.2
1
goharbor/harbor-registryctl:v2.9.0cce272836449
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
gradiant/open5gs-dbctl:0.10.3332031245fce
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
grafana/agent:v0.44.23364714a2f64
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/agent:v0.40.3f6cbec9409be
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
1
grafana/alloy:v1.5.101a63f4e032c
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/alloy:v1.4.306bdcbb51fc2
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/alloy:v1.1.1c3dac4e26471
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.0
4.5.2
5.2.2
1
grafana/grafana:10.1.50679e877ba20
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/grafana:9.4.71a359d92f40e
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
1
grafana/grafana:10.1.11b9ca4bbc4a2
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/grafana:9.5.239c849cebccc
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
1
grafana/grafana:11.2.2-security-01464eac539793
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:11.5.15781759b3d27
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:11.6.062d2b9d20a19
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:10.2.36b5b37eb35bb
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/grafana:9.4.376dcf36e7d2a
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
1
grafana/grafana:10.3.38640e5038e83
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
1
grafana/grafana:11.5.28b37a2f028f1
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:9.1.19746858c20e6
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.4.2
no fix listed
4.5.2
1
grafana/grafana:9.0.1a738d0744784
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.4.1
no fix listed
4.5.2
1
grafana/grafana:11.1.3b23b588cf7cb
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:8.3.5cd7cb4345aa7
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
grafana/grafana:8.3.4cf81d2c753c8
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
grafana/grafana:8.5.3ecc1b80b8ca2
github.com/golang-jwt/jwt@v3.2.1+incompatible
github.com/golang-jwt/jwt/v4@v4.2.0
no fix listed
4.5.2
1
grafana/grafana:10.4.0f9811e4e687f
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.0
4.5.2
5.2.2
1
grafana/grafana:11.3.1fa801ab6e1ae
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/loki:2.9.1035b02acc6765
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/loki:2.9.26074e01dbe03
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/loki:2.9.66ca6e2cd3b6f
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/loki:3.0.0757b5fadf816
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.0
4.5.2
5.2.2
1
grafana/loki:3.2.0882e30c20683
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/loki:3.3.28af2de1abbdd
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/loki:2.8.2b1da1d23037e
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
1
grafana/loki:2.4.2b3af8ead67d7
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
grafana/loki-canary:3.0.028d7c00588aa
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1
grafana/loki-canary:3.1.039baf6d67f85
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.