Most recent entries from all

ALSA-2025:3344 — Important: grafana security update

Affected: AlmaLinux:9: grafana, AlmaLinux:9: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-08472

certfr-2025-avi-0353 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0353

Withdrawn: CLEANSTART-2026-AQ94704 — Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the…

Withdrawn by the publisher.

Affected: CleanStart: minio-operator

Multiple security vulnerabilities affect the minio-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details.

EUVD-2026-228191

fkie_cve-2025-30204

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.

GHSA-mh63-6h87-95cp — jwt-go allows excessive memory allocation during header parsing

Affected: Go: github.com/golang-jwt/jwt/v5, Go: github.com/golang-jwt/jwt/v4, Go: github.com/golang-jwt/jwt

### Summary

Function [`parse.ParseUnverified`](https://github.com/golang-jwt/jwt/blob/c035977d9e11c351f4c05dfeae193923cbab49ee/parser.go#L138-L139) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request whose _Authorization_ header consists of `Bearer ` followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)

### Details

See [`parse.ParseUnverified`](https://github.com/golang-jwt/jwt/blob/c035977d9e11c351f4c05dfeae193923cbab49ee/parser.go#L138-L139)

### Impact

Excessive memory allocation

msrc_CVE-2025-30204 — jwt-go allows excessive memory allocation during header parsing

msrc_CVE-2025-30204

openSUSE-SU-2025:14937-1 — govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media

govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media

RHEA-2025:4438 — Red Hat Enhancement Advisory: Red Hat OpenShift Service on AWS 1.0 enhancements

golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

SUSE-SU-2025:1285-1 — Security update for etcd

Security update for etcd

UBUNTU-CVE-2025-30204

Affected: Ubuntu:22.04:LTS: golang-github-golang-jwt-jwt, Ubuntu:24.04:LTS: golang-github-golang-jwt-jwt, Ubuntu:24.04:LTS: golang-github-golang-jwt-jwt-v5

WID-SEC-W-2025-0633 — Gitea: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Daten zu manipulieren, oder einen Denial of Service auszulösen.