CVE-2025-30204

High

Advisory

Published 21 Mar 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.007; 52nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 580; of 17,781 indexed, latest versions
Container images: 621; deployed by those charts
Fix available: 2 of 3; affected packages

jwt-go allows excessive memory allocation during header parsing

Carried by container images the latest versions of 580 of 17,781 indexed charts deploy, on 621 images.

Affected package	Affected versions	Fixed in	Images
github.com/golang-jwt/jwt/v4golang	v4.0.0, v4.1.0, v4.2.0, v4.3.0+5 more	4.5.2	453
github.com/golang-jwt/jwt/v5golang	v5.0.0, v5.1.0, v5.2.0, v5.2.1	5.2.2	184
github.com/golang-jwt/jwtgolang	v3.2.1+incompatible, v3.2.2+incompatible	no fix listed	127

OSV records: GHSA-mh63-6h87-95cp
Also known as: GO-2025-3553

Charts affected

580 by stars

Chart

Latest

Affected images

Radar Score

open5gsopen5gs

2.3.4

1 of 5 See more

open5gs open5gs 2.3.4

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
gradiant/open5gs-dbctl :0.10.3	332031245fce	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

9,261

mattermostphntom

3.24.0

1 of 2 See more

mattermost phntom 3.24.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
phntom/mattermost-team-edition :9.3.0	51cf9da4aa2e	github.com/golang-jwt/jwt/v5@v5.0.0	5.2.2

Open the chart page →

8,722

uffizzi-appuffizzi-app

1.3.0

1 of 14 See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/jetstack/cert-manager-controller :v1.13.2	9c67cf8c92d8	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

19,337

aperture-controlleraperture

2.34.0

1 of 5 See more

aperture-controller aperture 2.34.0

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.33.5	91100b06e86d	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2

Open the chart page →

4,663

prometheusavesha

19.3.0

2 of 4 See more

prometheus avesha 19.3.0

2 of the 4 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.41.0	1a3e9a878e50	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.7.0	a15ca437f230	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

5,484

yatai-deploymentbentoml

1.1.21

1 of 2 See more

yatai-deployment bentoml 1.1.21

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/bentoml/yatai-deployment :1.1.21	2342cfe8c2a9	github.com/golang-jwt/jwt/v4@v4.4.1	4.5.2

Open the chart page →

1,160

cert-managerchoerodon

1.8.2

3 of 4 See more

cert-manager choerodon 1.8.2

3 of the 4 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/jetstack/cert-manager-cainjector :v1.8.2	c010246124c2	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2
quay.io/jetstack/cert-manager-controller :v1.8.2	a20c44021a5d	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2
quay.io/jetstack/cert-manager-ctl :v1.8.2	81b2d775edad	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2

Open the chart page →

7,775

coder-observabilitycoder-observability

0.7.3

7 of 21 See more

coder-observability coder-observability 0.7.3

7 of the 21 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/agent :v0.40.3	f6cbec9409be	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2
grafana/loki :3.1.0	d947e68a84d9	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.0	4.5.2 5.2.2
grafana/loki-canary :3.1.0	39baf6d67f85	github.com/golang-jwt/jwt/v5@v5.2.0	5.2.2
quay.io/minio/mc :RELEASE.2022-09-16T09-16-47Z	546a8b52d7b0	github.com/golang-jwt/jwt/v4@v4.4.1	4.5.2
quay.io/minio/minio :RELEASE.2022-09-17T00-09-45Z	c3d20bc2ea08	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2
quay.io/prometheus-operator/prometheus-config-reloader :v0.74.0	d55631c7a740	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2
quay.io/prometheus/prometheus :v2.53.1	f20d3127bf28	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

24,700

cosmocosmo-platform

0.20.0

2 of 10 See more

cosmo cosmo-platform 0.20.0

2 of the 10 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/graphqlmetrics :0.33.0	efb69ec3330c	github.com/golang-jwt/jwt/v5@v5.2.0	5.2.2
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

28,839

listmonkdeliveryhero

0.1.12

1 of 1 See more

listmonk deliveryhero 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
listmonk/listmonk :v2.1.0	d2eac77ddfad	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed

Open the chart page →

2,537

coreinstill-ai

0.1.75

2 of 15 See more

core instill-ai 0.1.75

2 of the 15 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
groundnuty/k8s-wait-for :v2.0	c14d7271e401	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2
library/influxdb :2.3.0-alpine	d7f5dd5f70e2	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed

Open the chart page →

30,816

kraken-cikraken-ci

1.7.36

1 of 10 See more

kraken-ci kraken-ci 1.7.36

1 of the 10 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-10-24T18-35-07Z	f9576903f19d	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

7,273

pyroscopekubeblocks

0.2.92

1 of 1 See more

pyroscope kubeblocks 0.2.92

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
apecloud/pyroscope :0.37.2	dbca95a15bc1	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed

Open the chart page →

1,620

kubeservice-lxcfs-webhookkubservice-charts

1.6.0

1 of 6 See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/jetstack/cert-manager-controller :v1.13.1	6b83f55bd99e	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

11,582

karporkusionstack

0.7.6

1 of 3 See more

karpor kusionstack 0.7.6

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/coreos/etcd :v3.5.11	842975891182	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

3,295

vcluster-k8sloft

0.0.0-ci.3

3 of 4 See more

vcluster-k8s loft 0.0.0-ci.3

3 of the 4 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
registry.k8s.io/etcd :3.5.6-0	dd75ec974b0a	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2
registry.k8s.io/kube-apiserver :v1.26.1	99e1ed9fbc8a	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2
registry.k8s.io/kube-controller-manager :v1.26.1	40adecbe3a40	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

5,570

kubecostmesosphere-stable

0.37.5

5 of 9 See more

kubecost mesosphere-stable 0.37.5

5 of the 9 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/grafana :9.4.7	1a359d92f40e	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2
gcr.io/kubecost1/cost-model :prod-1.108.1	852f7923fad3	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2
quay.io/prometheus-operator/prometheus-config-reloader :v0.69.1	7bbe804260f3	github.com/golang-jwt/jwt/v5@v5.0.0	5.2.2
quay.io/prometheus/prometheus :v2.55.0	378f4e037035	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2
quay.io/thanos/thanos :v0.36.1	e542959e1b36	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

17,693

move2kubemove2kube

0.3.15

1 of 1 See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/konveyor/move2kube-ui :latest	ec6ab507c5da	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

3,793

oesopsmx

4.0.32

1 of 25 See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/opsmxpublic/create-secret :v4.0.4	defc3263e0e9	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

107,811

ipfs-clusterparadeum-team

0.0.19

1 of 2 See more

ipfs-cluster paradeum-team 0.0.19

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ipfs/ipfs-cluster :1.0.2	1511f6d57994	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

3,757

permifypermify

0.5.0

1 of 1 See more

permify permify 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/permify/permify :v1.3.5	f0c6f7d7daa6	github.com/golang-jwt/jwt/v4@v4.5.1	4.5.2

Open the chart page →

997

plecopleco

0.24.0

1 of 1 See more

pleco pleco 0.24.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
public.ecr.aws/r3m4q3r9/pleco :0.24.0	651739583336	github.com/golang-jwt/jwt/v5@v5.0.0	5.2.2

Open the chart page →

1,346

corednssoftizy

0.2.0

1 of 1 See more

coredns softizy 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
coredns/coredns :1.10.1	a0ead06651cf	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

1,663

sn-platformstreamnative

1.11.44

3 of 9 See more

sn-platform streamnative 1.11.44

3 of the 9 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2
streamnative/pulsar_vault_init :v1.0.7	31533fa9fab7	github.com/golang-jwt/jwt/v4@v4.3.0	4.5.2
quay.io/prometheus/prometheus :v2.43.0	f5c29683a301	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

15,477

feedbacksystemthm-mni-ii

0.47.1

3 of 10 See more

feedbacksystem thm-mni-ii 0.47.1

3 of the 10 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
bitnamilegacy/minio :2023.12.23-debian-11-r2	5bb0aa825d16	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2
library/docker :20.10.21-dind	3153fa63f546	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2
thmmniii/fbs-runner :v1.27.1	86105349c1a3	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

28,534

argocdtwomartens

0.1.1

1 of 3 See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/argoproj/argocd :v2.8.6	acaf37352569	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.0	no fix listed 4.5.2

Open the chart page →

10,315

vouchvouch

3.2.0

1 of 1 See more

vouch vouch 3.2.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/vouch/vouch-proxy :0.39	d34e220de3cf	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed

Open the chart page →

1,031

vsphere-cpivsphere-tmm

1.6.0

1 of 1 See more

vsphere-cpi vsphere-tmm 1.6.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.28.0	026f63d9ed42	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2

Open the chart page →

1,344

gethvulcanlink

1.10.23

1 of 1 See more

geth vulcanlink 1.10.23

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.10.23	cce21b423165	github.com/golang-jwt/jwt/v4@v4.3.0	4.5.2

Open the chart page →

2,245

minio-operatorwenerme

4.3.7

1 of 2 See more

minio-operator wenerme 4.3.7

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
minio/operator :v4.3.7	54393e03f3b2	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed

Open the chart page →

6,085

wharf-helmwharf-helm

3.2.6

1 of 5 See more

wharf-helm wharf-helm 3.2.6

1 of the 5 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	github.com/golang-jwt/jwt/v4@v4.1.0	4.5.2

Open the chart page →

10,032

agentareaagentarea

0.0.18

1 of 16 See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
oryd/kratos :v1.3.1	fe2428f103a6	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2

Open the chart page →

14,914

clearml-servingallegroai

1.6.2

2 of 9 See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/grafana :9.4.3	76dcf36e7d2a	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2
quay.io/prometheus/prometheus :v2.41.0	1a3e9a878e50	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

17,877

smockerandrcuns

0.0.4

1 of 1 See more

smocker andrcuns 0.0.4

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
andrcuns/smocker :0.18.5	b4a8eb20581a	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed

Open the chart page →

2,173

anteonanteon

2.6.4

3 of 13 See more

anteon anteon 2.6.4

3 of the 13 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
chrislusf/seaweedfs :3.64	634b094b2183	github.com/golang-jwt/jwt/v5@v5.2.0	5.2.2
library/influxdb :2.6.1-alpine	44a366dd7724	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed
prom/prometheus :v2.37.9	8176adea328e	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

22,202

scannerappscode

2026.1.15

1 of 3 See more

scanner appscode 2026.1.15

1 of the 3 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
rancher/kine :v0.11.4	12889bbcd1e8	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

5,299

stash-enterpriseappscode

0.42.0

1 of 4 See more

stash-enterprise appscode 0.42.0

1 of the 4 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/stashed/stash-enterprise :v0.42.1	759f3850eda9	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

3,620

argocd-backup-s3argocd-backup-s3

0.9.5

1 of 1 See more

argocd-backup-s3 argocd-backup-s3 0.9.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/oguzhan-yilmaz/argocd-backup-s3 :latest	b61c750ade19	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2

Open the chart page →

5,222

kedaarieotech

0.1.0

2 of 3 See more

keda arieotech 0.1.0

2 of the 3 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/kedacore/keda :2.16.0	02348a19aeae	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	no fix listed 4.5.2 5.2.2
ghcr.io/kedacore/keda-metrics-apiserver :2.16.0	73a2ebae4413	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	no fix listed 4.5.2 5.2.2

Open the chart page →

2,276

chirpstackbeeinventor

0.1.10

2 of 5 See more

chirpstack beeinventor 0.1.10

2 of the 5 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
chirpstack/chirpstack-application-server :3.17.6	e0b23dfd24d6	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2
chirpstack/chirpstack-gateway-bridge :3.13.2	ce3f2cdca8a9	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2

Open the chart page →

7,807

helm-dashboardbeluga-cloud

2.4.0

1 of 1 See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard :1.3.3	9ab9a675c405	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2

Open the chart page →

2,898

bucket-backup-restorebucket-backup-restore

0.1.0

1 of 2 See more

bucket-backup-restore bucket-backup-restore 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
abohatyrenko/bucket-backup-restore :latest	fa98af15a13e	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2

Open the chart page →

2,042

finops-stackcert-manager

0.0.5

7 of 12 See more

finops-stack cert-manager 0.0.5

7 of the 12 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.3	b23b588cf7cb	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/background-controller :v1.12.5	06ed5db6cd33	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/cleanup-controller :v1.12.5	b914032ef9ad	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/kyverno :v1.12.5	a61c7022abcf	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/kyverno-cli :v1.12.5	832a32779e6d	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/kyvernopre :v1.12.5	63f7eaf5aa8a	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
ghcr.io/kyverno/reports-controller :v1.12.5	c62e3347611c	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2

Open the chart page →

12,562

cnpg-sandboxcloudnative-pg

0.6.1

1 of 6 See more

cnpg-sandbox cloudnative-pg 0.6.1

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
grafana/grafana :8.3.5	cd7cb4345aa7	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2

Open the chart page →

7,583

istio-allcode4devs

1.2.0

1 of 6 See more

istio-all code4devs 1.2.0

1 of the 6 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

4,784

cryptlex-enterprisecryptlex

3.21.25

1 of 8 See more

cryptlex-enterprise cryptlex 3.21.25

1 of the 8 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2025-03-12T18-04-18Z	46b3009bf704	github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2

Open the chart page →

2,345

revadcs3org

1.6.1

1 of 1 See more

revad cs3org 1.6.1

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
cs3org/revad :v1.24.0	e80a4d67b352	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed

Open the chart page →

1,704

dbrepodbrepo

1.13.3

2 of 25 See more

dbrepo dbrepo 1.13.3

2 of the 25 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2
bitnamilegacy/prometheus :2.54.1-debian-12-r4	08b1b7cb6a5b	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2

Open the chart page →

52,635

dregsydeliveryhero

0.1.5

1 of 1 See more

dregsy deliveryhero 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
xelalex/dregsy :0.4.3	574054e1c417	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed

Open the chart page →

2,969

trivy-operatordevopstales

2.5.0

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-30204.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2

Open the chart page →

5,598

Container images carrying it

621 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
kubesphere/ks-extensions-museum :latest	29681958f220	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.4.1	no fix listed 4.5.2	1
kusionstack/kusion :v0.14.0	126c8f0b0976	github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2	1
layer5/meshery :stable-latest	78a8be21bef3	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed	1
library/chronograf :1.9.4	96d8a3f65a4f	github.com/golang-jwt/jwt/v4@v4.0.0	4.5.2	1
library/docker :20.10.21-dind	3153fa63f546	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2	1
library/docker :27-dind	aa3df78ecf32	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2	1
library/docker :23.0.1-dind	d9a0fd8bdd15	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2	1
library/docker :26.1-dind	dd43b430341a	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
library/influxdb :2.7.4-alpine	a10d46445d68	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed	1
library/influxdb :2.0.8	ba10ac9ba17a	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed	1
library/influxdb :2.3.0-alpine	d7f5dd5f70e2	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed	1
library/kapacitor :1.6.3	7232f6388a4d	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed	1
library/telegraf :1.20.4	28e98eece020	github.com/golang-jwt/jwt/v4@v4.1.0	4.5.2	1
library/telegraf :1.27	507a3eecf809	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
library/traefik :v2.11.0	0a5157f742d2	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
library/traefik :v2.10.1	1489caffaedb	github.com/golang-jwt/jwt/v4@v4.2.0	4.5.2	1
library/traefik :2.10.6	1957e3314f43	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
library/vault :1.13.3	f98ac9dd97b0	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2	1
lightstep/microsatellite :2024-01-22_17-52-59Z	c800e05e1eff	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
lishimeng/owl-console :v0.11.2	c79a67657baf	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2	1
lishimeng/owl-messager :v0.11.2	3d00485e64dc	github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.0.0	4.5.2 5.2.2	1
logiqai/flash :v3.10.2	65b996bc7bdc	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.0 github.com/golang-jwt/jwt/v5@v5.2.1	no fix listed 4.5.2 5.2.2	1
markdegroot/unifi-protect-arm64 :latest	d8445f2a0de6	github.com/golang-jwt/jwt@v3.2.1+incompatible	no fix listed	1
mattermost/mattermost-push-proxy :6.3.0	45c53061c74e	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
megaease/easegress :latest	fad1c7452958	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v5@v5.0.0	no fix listed 5.2.2	1
mikejoh/argocd-extra-app-info-exporter :0.2.0	5c5a3b734271	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
minio/mc :RELEASE.2022-05-09T04-08-26Z	4b415310d8d0	github.com/golang-jwt/jwt/v4@v4.4.1	4.5.2	1
minio/mc :RELEASE.2024-01-16T16-06-34Z	591b097ea2d4	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
minio/mc :RELEASE.2023-02-28T00-12-59Z	c631532a394e	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.1.0	no fix listed 4.5.2	1
minio/minio :RELEASE.2025-01-20T14-49-07Z-cpuv1	14b7076ca85a	github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2	1
minio/minio :RELEASE.2024-05-28T17-19-04Z	391d1d45fdbe	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
minio/minio :RELEASE.2025-03-12T18-04-18Z	46b3009bf704	github.com/golang-jwt/jwt/v4@v4.5.1 github.com/golang-jwt/jwt/v5@v5.2.1	4.5.2 5.2.2	1
minio/minio :RELEASE.2024-01-16T16-07-38Z	4c4a4876193f	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
minio/minio :RELEASE.2024-01-18T22-51-28Z	551682a57a94	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
minio/minio :RELEASE.2023-03-20T20-16-18Z	6d770d7f255c	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
minio/minio :RELEASE.2023-11-20T22-40-07Z	b833a1699b4f	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
minio/minio :RELEASE.2022-10-24T18-35-07Z	f9576903f19d	github.com/golang-jwt/jwt/v4@v4.4.2	4.5.2	1
minio/minio :RELEASE.2023-01-12T02-06-16Z	fc6bedc99355	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2	1
minio/operator :v5.0.9	170b154d2c61	github.com/golang-jwt/jwt@v3.2.2+incompatible github.com/golang-jwt/jwt/v4@v4.5.0	no fix listed 4.5.2	1
moby/buildkit :v0.10.0	c2aeafaed434	github.com/golang-jwt/jwt/v4@v4.1.0	4.5.2	1
netbirdio/management :0.45.1	0c9994b393ea	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed	1
nineinfra/nineinfra :v0.7.0	d4aad414eccd	github.com/golang-jwt/jwt@v3.2.2+incompatible	no fix listed	1
offchainlabs/nitro-node :v3.1.0-7d1d84c	e95865866129	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
opencsghq/gitlab-gitaly :v17.5.0	bdd2c58b9744	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2	1
opencsghq/gitlab-shell :v17.5.0	f6d7e7d6be5d	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2	1
openmined/syft-seaweedfs :0.9.5	3a4144c0bb82	github.com/golang-jwt/jwt/v5@v5.2.0	5.2.2	1
optimizely/agent :4.0.0	9d0096cabd63	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2	1
orbitalreg/orbitalreg-api :0.1.0	45f2620337af	github.com/golang-jwt/jwt/v4@v4.4.3	4.5.2	1
oryd/hydra :v2.3.0	b94007e19a1f	github.com/golang-jwt/jwt/v5@v5.2.1	5.2.2	1