VDB
RHSA-2025%3A23916
RHSA-2025%3A23916
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/odf4/cephcsi-rhel9@sha256:b40c503ee411a75d143bcb6497f35a4345839f1cbb9347f9eec038c414c79e96_s390x as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/cephcsi-rhel9@sha256:b40c503ee411a75d143bcb6497f35a4345839f1cbb9347f9eec038c414c79e96_s390x, registry.redhat.io/odf4/cephcsi-rhel9@sha256:b40c503ee411a75d143bcb6497f35a4345839f1cbb9347f9eec038c414c79e96_s390x, registry.redhat.io/odf4/cephcsi-rhel9@sha256:b40c503ee411a75d143bcb6497f35a4345839f1cbb9347f9eec038c414c79e96_s390x |
| Red Hat | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:7bd68eaa93b9720ba4d843a67d4aa73e82d431312250b8c4a3e92d4a8f9a3062_s390x as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:7bd68eaa93b9720ba4d843a67d4aa73e82d431312250b8c4a3e92d4a8f9a3062_s390x, *, registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:7bd68eaa93b9720ba4d843a67d4aa73e82d431312250b8c4a3e92d4a8f9a3062_s390x |
| Red Hat | registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:4edc375b6b7b56179a3ec6cd57f0ad4fda42b2530ff070d4c18c966adc23f741_amd64 as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:4edc375b6b7b56179a3ec6cd57f0ad4fda42b2530ff070d4c18c966adc23f741_amd64, registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:4edc375b6b7b56179a3ec6cd57f0ad4fda42b2530ff070d4c18c966adc23f741_amd64, registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:4edc375b6b7b56179a3ec6cd57f0ad4fda42b2530ff070d4c18c966adc23f741_amd64 |
| Red Hat | registry.redhat.io/odf4/odr-rhel9-operator@sha256:ee11c555bb625609b807e10b7412d0de2b0def555e611e074cb17643ce53df05_arm64 as a component of Red Hat Openshift Data Foundation 4.18 | *, registry.redhat.io/odf4/odr-rhel9-operator@sha256:ee11c555bb625609b807e10b7412d0de2b0def555e611e074cb17643ce53df05_arm64, registry.redhat.io/odf4/odr-rhel9-operator@sha256:ee11c555bb625609b807e10b7412d0de2b0def555e611e074cb17643ce53df05_arm64 |
| Red Hat | registry.redhat.io/odf4/odr-rhel9-operator@sha256:ee11c555bb625609b807e10b7412d0de2b0def555e611e074cb17643ce53df05_arm64 as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/odr-rhel9-operator@sha256:ee11c555bb625609b807e10b7412d0de2b0def555e611e074cb17643ce53df05_arm64, registry.redhat.io/odf4/odr-rhel9-operator@sha256:ee11c555bb625609b807e10b7412d0de2b0def555e611e074cb17643ce53df05_arm64, registry.redhat.io/odf4/odr-rhel9-operator@sha256:ee11c555bb625609b807e10b7412d0de2b0def555e611e074cb17643ce53df05_arm64 |
| Red Hat | registry.redhat.io/odf4/odf-console-rhel9@sha256:ccc33cdbbd4ec7f94a3ff46ea02c74ce2af58a19be63e489c63f49ea001dcb18_ppc64le as a component of Red Hat Openshift Data Foundation 4.18 | *, registry.redhat.io/odf4/odf-console-rhel9@sha256:ccc33cdbbd4ec7f94a3ff46ea02c74ce2af58a19be63e489c63f49ea001dcb18_ppc64le, * |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:f59104c56a4af5c9e78b4fcaad0da3595a2c5e55a36606ea8d4f9f0ed5d813e8_arm64 as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:f59104c56a4af5c9e78b4fcaad0da3595a2c5e55a36606ea8d4f9f0ed5d813e8_arm64, registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:f59104c56a4af5c9e78b4fcaad0da3595a2c5e55a36606ea8d4f9f0ed5d813e8_arm64, registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:f59104c56a4af5c9e78b4fcaad0da3595a2c5e55a36606ea8d4f9f0ed5d813e8_arm64 |
| Red Hat | registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:e0e9ae74d89ee53c7172d1fa8f0ff5bd35f9c242b139ce428bbec05b8122774a_ppc64le as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:e0e9ae74d89ee53c7172d1fa8f0ff5bd35f9c242b139ce428bbec05b8122774a_ppc64le, registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:e0e9ae74d89ee53c7172d1fa8f0ff5bd35f9c242b139ce428bbec05b8122774a_ppc64le, registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:e0e9ae74d89ee53c7172d1fa8f0ff5bd35f9c242b139ce428bbec05b8122774a_ppc64le |
| Red Hat | registry.redhat.io/odf4/odf-operator-bundle@sha256:80cc40018d47da8d1d2a84aef55346cd98db4362e2e89a0a340f29c18e5c6276_amd64 as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/odf-operator-bundle@sha256:80cc40018d47da8d1d2a84aef55346cd98db4362e2e89a0a340f29c18e5c6276_amd64, registry.redhat.io/odf4/odf-operator-bundle@sha256:80cc40018d47da8d1d2a84aef55346cd98db4362e2e89a0a340f29c18e5c6276_amd64, registry.redhat.io/odf4/odf-operator-bundle@sha256:80cc40018d47da8d1d2a84aef55346cd98db4362e2e89a0a340f29c18e5c6276_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-cli-rhel9@sha256:18389875fbd5150ff7fdf4073ba54b70e5cf7efaaa429e1c9f599ccb801ad9a0_amd64 as a component of Red Hat Openshift Data Foundation 4.18 | *, *, registry.redhat.io/odf4/odf-cli-rhel9@sha256:18389875fbd5150ff7fdf4073ba54b70e5cf7efaaa429e1c9f599ccb801ad9a0_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:b59c062f82c3e77a060c2ffbfc56408c8dde2bfb4b5da1b8f97d788f3123a10e_ppc64le as a component of Red Hat Openshift Data Foundation 4.18 | *, *, registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:b59c062f82c3e77a060c2ffbfc56408c8dde2bfb4b5da1b8f97d788f3123a10e_ppc64le |
| Red Hat | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:919e13c15f5b39c80bf725c643f2c577f8316ad16d0dd83fff4c365156ea5e23_ppc64le as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:919e13c15f5b39c80bf725c643f2c577f8316ad16d0dd83fff4c365156ea5e23_ppc64le, registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:919e13c15f5b39c80bf725c643f2c577f8316ad16d0dd83fff4c365156ea5e23_ppc64le, * |
| Red Hat | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:9dcc19c404b3b9ce0afc363f565d3f5c797a0486031cee23619dc38d9eab391c_ppc64le as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:9dcc19c404b3b9ce0afc363f565d3f5c797a0486031cee23619dc38d9eab391c_ppc64le, registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:9dcc19c404b3b9ce0afc363f565d3f5c797a0486031cee23619dc38d9eab391c_ppc64le, * |
| Red Hat | registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:5a8aab0d45ff44274c7331a55229c261ea3ce3ca9368f8dd285c6168e4ac9e4b_ppc64le as a component of Red Hat Openshift Data Foundation 4.18 | *, registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:5a8aab0d45ff44274c7331a55229c261ea3ce3ca9368f8dd285c6168e4ac9e4b_ppc64le, registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:5a8aab0d45ff44274c7331a55229c261ea3ce3ca9368f8dd285c6168e4ac9e4b_ppc64le |
| Red Hat | registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:a1301b098696bbde8094067be1905e71028f2a1e1844af3b9a98872a672fea93_ppc64le as a component of Red Hat Openshift Data Foundation 4.18 | *, registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:a1301b098696bbde8094067be1905e71028f2a1e1844af3b9a98872a672fea93_ppc64le, * |
| Red Hat | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:7bd68eaa93b9720ba4d843a67d4aa73e82d431312250b8c4a3e92d4a8f9a3062_s390x as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:7bd68eaa93b9720ba4d843a67d4aa73e82d431312250b8c4a3e92d4a8f9a3062_s390x, registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:7bd68eaa93b9720ba4d843a67d4aa73e82d431312250b8c4a3e92d4a8f9a3062_s390x, registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:7bd68eaa93b9720ba4d843a67d4aa73e82d431312250b8c4a3e92d4a8f9a3062_s390x |
| Red Hat | registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:4edc375b6b7b56179a3ec6cd57f0ad4fda42b2530ff070d4c18c966adc23f741_amd64 as a component of Red Hat Openshift Data Foundation 4.18 | *, registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:4edc375b6b7b56179a3ec6cd57f0ad4fda42b2530ff070d4c18c966adc23f741_amd64, registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:4edc375b6b7b56179a3ec6cd57f0ad4fda42b2530ff070d4c18c966adc23f741_amd64 |
| Red Hat | registry.redhat.io/odf4/ocs-rhel9-operator@sha256:1cf0c241cc8838b016282c4f742a9d420561b660e16eb03734590df05be5d18a_amd64 as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/ocs-rhel9-operator@sha256:1cf0c241cc8838b016282c4f742a9d420561b660e16eb03734590df05be5d18a_amd64, *, * |
| Red Hat | registry.redhat.io/odf4/odr-rhel9-operator@sha256:9e6e30483c87bd06d0a4c632fe71458130a03296cf45afc3bcab28d032ea5c61_s390x as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/odr-rhel9-operator@sha256:9e6e30483c87bd06d0a4c632fe71458130a03296cf45afc3bcab28d032ea5c61_s390x, registry.redhat.io/odf4/odr-rhel9-operator@sha256:9e6e30483c87bd06d0a4c632fe71458130a03296cf45afc3bcab28d032ea5c61_s390x, * |
| Red Hat | registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:28e471544609150a052f866cd1a8adbe4af3a80e2a5c5f093a0de5178a93f91b_s390x as a component of Red Hat Openshift Data Foundation 4.18 | registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:28e471544609150a052f866cd1a8adbe4af3a80e2a5c5f093a0de5178a93f91b_s390x, registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:28e471544609150a052f866cd1a8adbe4af3a80e2a5c5f093a0de5178a93f91b_s390x, * |
…and 142 more
Timeline
- Dec 22, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:23916 advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 advisory
- https://access.redhat.com/security/cve/CVE-2025-47907 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23916.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://www.cve.org/CVERecord?id=CVE-2025-30204 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-30204 advisory
- https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 advisory
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp advisory
- https://pkg.go.dev/vuln/GO-2025-3553 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2387083 issue
- https://www.cve.org/CVERecord?id=CVE-2025-47907 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47907 advisory
- https://go.dev/cl/693735 advisory
- https://go.dev/issue/74831 advisory
- https://groups.google.com/g/golang-announce/c/x5MKroML2yM advisory
- https://pkg.go.dev/vuln/GO-2025-3849 advisory