Golang-Jwt Jwt vulnerabilities
2 known vulnerabilities affecting golang-jwt/jwt.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1LOW1
Vulnerabilities
Page 1 of 1
CVE-2025-30204HIGHCVSS 7.5v>= 3.2.0, < 4.5.2v>= 5.0.0-rc.1, < 5.2.22025-03-21
CVE-2025-30204 [HIGH] CWE-405 CVE-2025-30204: golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to version
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many
nvd
CVE-2024-51744LOWCVSS 3.1fixed in 4.5.12024-11-04
CVE-2024-51744 [LOW] CWE-755 CVE-2024-51744: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check
nvd