StackRadar

CVE-2025-30204

High

Advisory

Published 21 Mar 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
580
of 17,781 indexed, latest versions
Container images
621
deployed by those charts
Fix available
2 of 3
affected packages

jwt-go allows excessive memory allocation during header parsing

Carried by container images the latest versions of 580 of 17,781 indexed charts deploy, on 621 images.

Affected packageAffected versionsFixed inImages
github.com/golang-jwt/jwt/v4golangv4.0.0, v4.1.0, v4.2.0, v4.3.0+5 more4.5.2453
github.com/golang-jwt/jwt/v5golangv5.0.0, v5.1.0, v5.2.0, v5.2.15.2.2184
github.com/golang-jwt/jwtgolangv3.2.1+incompatible, v3.2.2+incompatibleno fix listed127
OSV records
GHSA-mh63-6h87-95cp
Also known as
GO-2025-3553

Charts affected

580 by stars
ChartLatestAffected imagesRadar Score
dockyarddockyardVerified publisher0.4.01 of 1See more

dockyard dockyard 0.4.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/kgma74/dockyard:0.4.0b40439329191
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

1,542
thermitedollarshaveclubOfficialVerified publisher0.1.171 of 1See more

thermite dollarshaveclub 0.1.17

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
dollarshaveclub/thermite:0.0.31663cbf25fcfe
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

2,732
dragonfly-stackdragonflyVerified publisher0.1.21 of 7See more

dragonfly-stack dragonfly 0.1.2

1 of the 7 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
dragonflyoss/manager:v2.1.49c3ef7f10698d
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

18,376
gethdysnixVerified publisher1.1.21 of 1See more

geth dysnix 1.1.2

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ethereum/client-go:v1.14.8886ec69b35b0
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

1,624
elchi-stackelchi1.13.01 of 10See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.89.0995f17004231
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2

Open the chart page →

15,383
beaconchain-explorerethereum-helm-chartsVerified publisher0.1.61 of 2See more

beaconchain-explorer ethereum-helm-charts 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
gobitfly/eth2-beaconchain-explorer:latest1d08a7986348
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.1
no fix listed
4.5.2

Open the chart page →

3,048
ipfs-clusterethereum-helm-chartsVerified publisher0.1.141 of 3See more

ipfs-cluster ethereum-helm-charts 0.1.14

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
lachlanevenson/k8s-kubectl:v1.25.4af5cea3f2e40
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

4,614
github-actions-runner-operatorevryfs-ossVerified publisher2.8.11 of 1See more

github-actions-runner-operator evryfs-oss 2.8.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/evryfs/github-actions-runner-operator:v0.11.16b084e0bd082
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

1,236
free5gcfree5gcVerified publisher0.1.310 of 12See more

free5gc free5gc 0.1.3

10 of the 12 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
free5gc/amf:v3.4.31bc96ff5a2a6
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
free5gc/ausf:v3.4.3687ff4daf5da
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed
free5gc/chf:v3.4.3e2a4dd98a4ed
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
free5gc/nrf:v3.4.399e46b860efb
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
free5gc/nssf:v3.4.3dfe8c68c04b4
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed
free5gc/pcf:v3.4.3f712e8ecd927
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed
free5gc/smf:v3.4.360e38baa4b10
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed
free5gc/udm:v3.4.32f68df062a50
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed
free5gc/udr:v3.4.3c0783bcdcbdc
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed
free5gc/webui:v3.4.39adeb18492cb
github.com/golang-jwt/jwt@v3.2.1+incompatible
github.com/golang-jwt/jwt/v5@v5.2.1
no fix listed
5.2.2

Open the chart page →

10,693
memosgabe565Verified publisher0.17.01 of 1See more

memos gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/usememos/memos:0.24.04723d86e6797
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v5@v5.2.1
no fix listed
5.2.2

Open the chart page →

1,323
otel-collectorgeek-cookbookVerified publisher1.2.21 of 1See more

otel-collector geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.46.0ba173aa85f3f
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

2,556
temporalglasskubeVerified publisher0.45.2-gk.16 of 14See more

temporal glasskube 0.45.2-gk.1

6 of the 14 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:11.0.00dc5a246ab16
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
temporalio/admin-tools:1.25.0-tctl-1.18.1-cli-1.0.0cda4901bab53
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2
temporalio/server:1.25.08a5798191dea
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2
temporalio/ui:2.30.25c2a3645d09c
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed
quay.io/prometheus-operator/prometheus-config-reloader:v0.74.0d55631c7a740
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
quay.io/prometheus/prometheus:v2.53.0075b1ba2c4eb
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

16,346
meta-monitoringgrafana1.3.01 of 2See more

meta-monitoring grafana 1.3.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

3,518
phlaregrafana0.5.41 of 1See more

phlare grafana 0.5.4

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/phlare:0.5.1330f990cdad9
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2

Open the chart page →

2,084
carettagroundcover0.0.161 of 3See more

caretta groundcover 0.0.16

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/groundcover/grafana:9.3.18c65b333a3d3
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.4.2
no fix listed
4.5.2

Open the chart page →

6,799
hawkhawk1.1.51 of 4See more

hawk hawk 1.1.5

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:8.5.042d3e6bc1865
github.com/golang-jwt/jwt@v3.2.1+incompatible
github.com/golang-jwt/jwt/v4@v4.2.0
no fix listed
4.5.2

Open the chart page →

13,610
jetic-operatorjetic-operatorVerified publisher2.0.21 of 1See more

jetic-operator jetic-operator 2.0.2

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
apache/camel-k:1.10.43bb13d14f64a
github.com/golang-jwt/jwt/v4@v4.3.0
4.5.2

Open the chart page →

9,318
joylive-injectorjoyliveOfficialVerified publisher1.3.51 of 2See more

joylive-injector joylive 1.3.5

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
otel/opentelemetry-collector:0.100.09e36620d6c2c
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2

Open the chart page →

1,273
todo-appjunktext-direct1.1.41 of 1See more

todo-app junktext-direct 1.1.4

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
junktext/getting-started:1.0.5a70936c04aed
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2

Open the chart page →

3,369
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.322 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

2 of the 17 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2024-11-21T17-21-54Z993e8c454a7e
github.com/golang-jwt/jwt/v4@v4.5.1
4.5.2
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

15,418
keycloak-client-operatorkeycloak-client-operator0.9.11 of 1See more

keycloak-client-operator keycloak-client-operator 0.9.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
registry.gitlab.com/lenitech/k8s-operator/keycloak-client:v0.6.19065cdd80035
github.com/golang-jwt/jwt/v5@v5.0.0
5.2.2

Open the chart page →

507
kokukokuVerified publisher1.0.01 of 7See more

koku koku 1.0.0

1 of the 7 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
public.ecr.aws/v0r6c2e2/minio:latest08c90bd040bf
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

12,019
ks-corekubeblocksVerified publisher1.1.31 of 5See more

ks-core kubeblocks 1.1.3

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
kubesphere/ks-extensions-museum:latest29681958f220
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.4.1
no fix listed
4.5.2

Open the chart page →

4,721
kubernetes-stateless-chartkubernetes-stateless-chart1.0.31 of 1See more

kubernetes-stateless-chart kubernetes-stateless-chart 1.0.3

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

3,274
juicefskubesphere-stable0.16.21 of 4See more

juicefs kubesphere-stable 0.16.2

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.20.043978fc60798
github.com/golang-jwt/jwt@v3.2.1+incompatible
no fix listed

Open the chart page →

2,489
mesherykubesphere-stable0.5.01 of 13See more

meshery kubesphere-stable 0.5.0

1 of the 13 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
layer5/meshery:stable-latest78a8be21bef3
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

24,690
kubeservice-cosign-webhookkubservice-chartsVerified publisher1.1.11 of 5See more

kubeservice-cosign-webhook kubservice-charts 1.1.1

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.13.16b83f55bd99e
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

7,087
kubeservice-custom-limitrangekubservice-chartsVerified publisher1.3.01 of 5See more

kubeservice-custom-limitrange kubservice-charts 1.3.0

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.13.16b83f55bd99e
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

5,941
kubeservice-namespace-node-affinitykubservice-chartsVerified publisher1.1.21 of 5See more

kubeservice-namespace-node-affinity kubservice-charts 1.1.2

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.13.16b83f55bd99e
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

6,872
kube-fencingkvaps2.4.11 of 2See more

kube-fencing kvaps 2.4.1

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/kvaps/kube-fencing-controller:v2.4.0313edfec2fca
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

2,536
lgtm-stacklgtm-stackVerified publisher0.1.32 of 8See more

lgtm-stack lgtm-stack 0.1.3

2 of the 8 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
minio/mc:RELEASE.2024-01-16T16-06-34Z591b097ea2d4
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
minio/minio:RELEASE.2024-01-18T22-51-28Z551682a57a94
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

5,576
linkerd-jaegerlinkerd2-edgeVerified publisher30.14.11-edge1 of 4See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2

Open the chart page →

4,389
vcluster-eksloftVerified publisher0.0.0-ci.31 of 4See more

vcluster-eks loft 0.0.0-ci.3

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
public.ecr.aws/eks-distro/etcd-io/etcd:v3.5.6-eks-1-24-7efa6dee17ed2
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

3,304
mw-kube-agent-v2middleware-labsVerified publisher2.8.61 of 1See more

mw-kube-agent-v2 middleware-labs 2.8.6

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

4,137
chartmuseummike75151.2.01 of 1See more

chartmuseum mike7515 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/helm/chartmuseum:v0.15.0c298183a5208
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.4.1
no fix listed
4.5.2

Open the chart page →

3,168
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2023.12.230b60b6565ab2
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2

Open the chart page →

37,373
oadaoadaVerified publisher5.0.51 of 11See more

oada oada 5.0.5

1 of the 11 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
groundnuty/k8s-wait-for:no-root-v2.0a26d3d3f6e1c
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2

Open the chart page →

13,317
orbitalregorbitalregVerified publisher0.3.01 of 4See more

orbitalreg orbitalreg 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
orbitalreg/orbitalreg-api:0.1.045f2620337af
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2

Open the chart page →

2,278
spirephilips-labsVerified publisher0.12.22 of 6See more

spire philips-labs 0.12.2

2 of the 6 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/spiffe/spire-agent:1.6.062517726d0c4
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
ghcr.io/spiffe/spire-server:1.6.0635b9024cad2
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2

Open the chart page →

7,236
chartmuseumphntom4.0.201 of 1See more

chartmuseum phntom 4.0.20

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.16.053883b65d9b7
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.4.1
no fix listed
4.5.2

Open the chart page →

2,939
velero-s3-deploymentradar-baseVerified publisher0.4.21 of 4See more

velero-s3-deployment radar-base 0.4.2

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2024-11-21T17-21-54Z993e8c454a7e
github.com/golang-jwt/jwt/v4@v4.5.1
4.5.2

Open the chart page →

4,798
rclonercloneVerified publisher2.2.01 of 1See more

rclone rclone 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
rclone/rclone:1.6874c51b8817e5
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2

Open the chart page →

1,672
backup-repository-serverriotkit-org4.0.01 of 1See more

backup-repository-server riotkit-org 4.0.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/backup-repository:v4.0.0ab41ffa78f69
github.com/golang-jwt/jwt/v4@v4.4.1
4.5.2

Open the chart page →

2,049
grafanaromanow-helm-chartsVerified publisher1.7.11 of 1See more

grafana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
grafana/grafana:8.3.4cf81d2c753c8
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2

Open the chart page →

2,835
prometheusromanow-helm-chartsVerified publisher1.7.21 of 1See more

prometheus romanow-helm-charts 1.7.2

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
prom/prometheus:v2.52.05c435642ca4d
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2

Open the chart page →

1,143
ntfysarab97Verified publisher0.1.71 of 1See more

ntfy sarab97 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
binwiederhier/ntfy:v2.6.283e2e43d9956
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2

Open the chart page →

1,766
scienceboxsciencebox0.0.71 of 17See more

sciencebox sciencebox 0.0.7

1 of the 17 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
cs3org/revad:v1.19.03b57a34a7dfd
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

6,587
iopsciencemeshVerified publisher0.4.01 of 2See more

iop sciencemesh 0.4.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
cs3org/revad:v1.24.0e80a4d67b352
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed

Open the chart page →

4,052
cosignedsigstoreVerified publisher0.1.232 of 2See more

cosigned sigstore 0.1.23

2 of the 2 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
gcr.io/projectsigstore/cosigneddigest-pinned784518ff3ee7
github.com/golang-jwt/jwt/v4@v4.3.0
4.5.2
gcr.io/projectsigstore/policy-webhookdigest-pinned82940e8c3e0d
github.com/golang-jwt/jwt/v4@v4.3.0
4.5.2

Open the chart page →

5,118
mongodb-backupsinextraVerified publisher1.1.01 of 1See more

mongodb-backup sinextra 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/mongodb:8.0.101eee8e20a87f
github.com/golang-jwt/jwt@v3.2.1+incompatible
github.com/golang-jwt/jwt/v4@v4.5.0
no fix listed
4.5.2

Open the chart page →

4,238

Container images carrying it

621 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
galaxy/cloudman-server:lateste5c265fe9fcd
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
gitea/gitea:1.22.376f516a1a8c2
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
gitea/gitea:1.21.6ac73e0da341f
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
1
goalert/goalert:v0.32.008d57388b0cb
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1
gobitfly/eth2-beaconchain-explorer:latest1d08a7986348
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.5.1
no fix listed
4.5.2
1
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.2.0
no fix listed
4.5.2
1
goharbor/harbor-acceld:0.2.13451103a6c8d8
github.com/golang-jwt/jwt@v3.2.2+incompatible
no fix listed
1
goharbor/harbor-core:v2.9.06412d679fdc3
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
1
goharbor/harbor-core:v2.5.386bf3031f4a7
github.com/golang-jwt/jwt/v4@v4.1.0
4.5.2
1
goharbor/harbor-core:v2.11.1c017dd84ee96
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
github.com/golang-jwt/jwt/v4@v4.1.0
4.5.2
1
goharbor/harbor-registryctl:v2.9.0cce272836449
github.com/golang-jwt/jwt/v4@v4.4.2
4.5.2
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/golang-jwt/jwt/v4@v4.2.0
4.5.2
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
gradiant/open5gs-dbctl:0.10.3332031245fce
github.com/golang-jwt/jwt/v5@v5.2.1
5.2.2
1
grafana/agent:v0.44.23364714a2f64
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/agent:v0.40.3f6cbec9409be
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
1
grafana/alloy:v1.5.101a63f4e032c
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/alloy:v1.4.306bdcbb51fc2
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/alloy:v1.1.1c3dac4e26471
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.0
4.5.2
5.2.2
1
grafana/grafana:10.1.50679e877ba20
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/grafana:9.4.71a359d92f40e
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
1
grafana/grafana:10.1.11b9ca4bbc4a2
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/grafana:9.5.239c849cebccc
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
1
grafana/grafana:11.2.2-security-01464eac539793
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:11.5.15781759b3d27
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:11.6.062d2b9d20a19
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:10.2.36b5b37eb35bb
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/grafana:9.4.376dcf36e7d2a
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
1
grafana/grafana:10.3.38640e5038e83
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.0.0
4.5.2
5.2.2
1
grafana/grafana:11.5.28b37a2f028f1
github.com/golang-jwt/jwt/v4@v4.5.1
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:9.1.19746858c20e6
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.4.2
no fix listed
4.5.2
1
grafana/grafana:9.0.1a738d0744784
github.com/golang-jwt/jwt@v3.2.2+incompatible
github.com/golang-jwt/jwt/v4@v4.4.1
no fix listed
4.5.2
1
grafana/grafana:11.1.3b23b588cf7cb
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/grafana:8.3.5cd7cb4345aa7
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
grafana/grafana:8.3.4cf81d2c753c8
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
grafana/grafana:8.5.3ecc1b80b8ca2
github.com/golang-jwt/jwt@v3.2.1+incompatible
github.com/golang-jwt/jwt/v4@v4.2.0
no fix listed
4.5.2
1
grafana/grafana:10.4.0f9811e4e687f
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.0
4.5.2
5.2.2
1
grafana/grafana:11.3.1fa801ab6e1ae
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/loki:2.9.1035b02acc6765
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/loki:2.9.26074e01dbe03
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/loki:2.9.66ca6e2cd3b6f
github.com/golang-jwt/jwt/v4@v4.5.0
4.5.2
1
grafana/loki:3.0.0757b5fadf816
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.0
4.5.2
5.2.2
1
grafana/loki:3.2.0882e30c20683
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/loki:3.3.28af2de1abbdd
github.com/golang-jwt/jwt/v4@v4.5.0
github.com/golang-jwt/jwt/v5@v5.2.1
4.5.2
5.2.2
1
grafana/loki:2.8.2b1da1d23037e
github.com/golang-jwt/jwt/v4@v4.4.3
4.5.2
1
grafana/loki:2.4.2b3af8ead67d7
github.com/golang-jwt/jwt/v4@v4.0.0
4.5.2
1
grafana/loki-canary:3.0.028d7c00588aa
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1
grafana/loki-canary:3.1.039baf6d67f85
github.com/golang-jwt/jwt/v5@v5.2.0
5.2.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.