VDB
RHSA-2025%3A3905
RHSA-2025%3A3905
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-logging/vector-rhel9@sha256:483bb4b32ff0932e96a5572a386ecb3e4c605cacfc515d7029f23f572d0e6254_s390x as a component of RHOL 6.0 for RHEL 9 | openshift-logging/vector-rhel9@sha256:483bb4b32ff0932e96a5572a386ecb3e4c605cacfc515d7029f23f572d0e6254_s390x, openshift-logging/vector-rhel9@sha256:483bb4b32ff0932e96a5572a386ecb3e4c605cacfc515d7029f23f572d0e6254_s390x, openshift-logging/vector-rhel9@sha256:483bb4b32ff0932e96a5572a386ecb3e4c605cacfc515d7029f23f572d0e6254_s390x |
| Red Hat | openshift-logging/log-file-metric-exporter-rhel9@sha256:0bc239163627bd0b502d74072d5fd8f6606b222784d24963bcc6d104353221c8_arm64 as a component of RHOL 6.0 for RHEL 9 | openshift-logging/log-file-metric-exporter-rhel9@sha256:0bc239163627bd0b502d74072d5fd8f6606b222784d24963bcc6d104353221c8_arm64, openshift-logging/log-file-metric-exporter-rhel9@sha256:0bc239163627bd0b502d74072d5fd8f6606b222784d24963bcc6d104353221c8_arm64, openshift-logging/log-file-metric-exporter-rhel9@sha256:0bc239163627bd0b502d74072d5fd8f6606b222784d24963bcc6d104353221c8_arm64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:235869e45d6b6cd7175196388a44417729d0a120e904dae5d8004492621ba18e_ppc64le as a component of RHOL 6.0 for RHEL 9 | openshift-logging/lokistack-gateway-rhel9@sha256:235869e45d6b6cd7175196388a44417729d0a120e904dae5d8004492621ba18e_ppc64le, openshift-logging/lokistack-gateway-rhel9@sha256:235869e45d6b6cd7175196388a44417729d0a120e904dae5d8004492621ba18e_ppc64le, * |
| Red Hat | openshift-logging/loki-rhel9-operator@sha256:dbd678a763c5c61a8d14de435bf486d639ba57393cb27d81f5c53922da46fd79_ppc64le as a component of RHOL 6.0 for RHEL 9 | openshift-logging/loki-rhel9-operator@sha256:dbd678a763c5c61a8d14de435bf486d639ba57393cb27d81f5c53922da46fd79_ppc64le, *, openshift-logging/loki-rhel9-operator@sha256:dbd678a763c5c61a8d14de435bf486d639ba57393cb27d81f5c53922da46fd79_ppc64le |
| Red Hat | openshift-logging/opa-openshift-rhel9@sha256:e491fa256442a3ea58c0d7f6f6fe3dcf2ceb5e05528f7a39a03033e4cd263477_ppc64le as a component of RHOL 6.0 for RHEL 9 | openshift-logging/opa-openshift-rhel9@sha256:e491fa256442a3ea58c0d7f6f6fe3dcf2ceb5e05528f7a39a03033e4cd263477_ppc64le, openshift-logging/opa-openshift-rhel9@sha256:e491fa256442a3ea58c0d7f6f6fe3dcf2ceb5e05528f7a39a03033e4cd263477_ppc64le, openshift-logging/opa-openshift-rhel9@sha256:e491fa256442a3ea58c0d7f6f6fe3dcf2ceb5e05528f7a39a03033e4cd263477_ppc64le |
| Red Hat | openshift-logging/opa-openshift-rhel9@sha256:60da8741596816a1bfbb4b40eb22a06b996ef18fcb4668ac6d41d0af7794bb08_s390x as a component of RHOL 6.0 for RHEL 9 | openshift-logging/opa-openshift-rhel9@sha256:60da8741596816a1bfbb4b40eb22a06b996ef18fcb4668ac6d41d0af7794bb08_s390x, openshift-logging/opa-openshift-rhel9@sha256:60da8741596816a1bfbb4b40eb22a06b996ef18fcb4668ac6d41d0af7794bb08_s390x, openshift-logging/opa-openshift-rhel9@sha256:60da8741596816a1bfbb4b40eb22a06b996ef18fcb4668ac6d41d0af7794bb08_s390x |
| Red Hat | openshift-logging/eventrouter-rhel9@sha256:6fc3e68cc69f8ce6eb93244fc344260b48ac68794da1ce78aeb4fad606576789_arm64 as a component of RHOL 6.0 for RHEL 9 | openshift-logging/eventrouter-rhel9@sha256:6fc3e68cc69f8ce6eb93244fc344260b48ac68794da1ce78aeb4fad606576789_arm64, openshift-logging/eventrouter-rhel9@sha256:6fc3e68cc69f8ce6eb93244fc344260b48ac68794da1ce78aeb4fad606576789_arm64, openshift-logging/eventrouter-rhel9@sha256:6fc3e68cc69f8ce6eb93244fc344260b48ac68794da1ce78aeb4fad606576789_arm64 |
| Red Hat | openshift-logging/logging-loki-rhel9@sha256:4c9aae2b3560cb6bc67ef536459ed04e30b0890e3b34c8fbbfaa7557b449bc44_amd64 as a component of RHOL 6.0 for RHEL 9 | openshift-logging/logging-loki-rhel9@sha256:4c9aae2b3560cb6bc67ef536459ed04e30b0890e3b34c8fbbfaa7557b449bc44_amd64, openshift-logging/logging-loki-rhel9@sha256:4c9aae2b3560cb6bc67ef536459ed04e30b0890e3b34c8fbbfaa7557b449bc44_amd64, openshift-logging/logging-loki-rhel9@sha256:4c9aae2b3560cb6bc67ef536459ed04e30b0890e3b34c8fbbfaa7557b449bc44_amd64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:9ab91722ff31aa128c9d85a72aa56eaccd7ed5824c97e751e665f43fb771b52b_arm64 as a component of RHOL 6.0 for RHEL 9 | *, *, * |
| Red Hat | openshift-logging/cluster-logging-operator-bundle@sha256:83a7739027f372c2656818afb0667aa9e4bee3e8e57caf943398763e0bd95a7d_amd64 as a component of RHOL 6.0 for RHEL 9 | openshift-logging/cluster-logging-operator-bundle@sha256:83a7739027f372c2656818afb0667aa9e4bee3e8e57caf943398763e0bd95a7d_amd64, openshift-logging/cluster-logging-operator-bundle@sha256:83a7739027f372c2656818afb0667aa9e4bee3e8e57caf943398763e0bd95a7d_amd64, openshift-logging/cluster-logging-operator-bundle@sha256:83a7739027f372c2656818afb0667aa9e4bee3e8e57caf943398763e0bd95a7d_amd64 |
| Red Hat | openshift-logging/cluster-logging-rhel9-operator@sha256:973e8d043405e3b60cc48baed5b9ed5247738147c25ead037f53d006a92436bc_s390x as a component of RHOL 6.0 for RHEL 9 | openshift-logging/cluster-logging-rhel9-operator@sha256:973e8d043405e3b60cc48baed5b9ed5247738147c25ead037f53d006a92436bc_s390x, openshift-logging/cluster-logging-rhel9-operator@sha256:973e8d043405e3b60cc48baed5b9ed5247738147c25ead037f53d006a92436bc_s390x, openshift-logging/cluster-logging-rhel9-operator@sha256:973e8d043405e3b60cc48baed5b9ed5247738147c25ead037f53d006a92436bc_s390x |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:fa23bcf8aa7db1b76cf204feaef55b48dcb37d9ec7f8d5d3185a86dcf5b7db26_s390x as a component of RHOL 6.0 for RHEL 9 | openshift-logging/lokistack-gateway-rhel9@sha256:fa23bcf8aa7db1b76cf204feaef55b48dcb37d9ec7f8d5d3185a86dcf5b7db26_s390x, openshift-logging/lokistack-gateway-rhel9@sha256:fa23bcf8aa7db1b76cf204feaef55b48dcb37d9ec7f8d5d3185a86dcf5b7db26_s390x, openshift-logging/lokistack-gateway-rhel9@sha256:fa23bcf8aa7db1b76cf204feaef55b48dcb37d9ec7f8d5d3185a86dcf5b7db26_s390x |
| Red Hat | openshift-logging/vector-rhel9@sha256:9183e9614e3f963be71158dc75eee5d8f16e1c177775544094cef5c115ba743f_arm64 as a component of RHOL 6.0 for RHEL 9 | *, openshift-logging/vector-rhel9@sha256:9183e9614e3f963be71158dc75eee5d8f16e1c177775544094cef5c115ba743f_arm64, openshift-logging/vector-rhel9@sha256:9183e9614e3f963be71158dc75eee5d8f16e1c177775544094cef5c115ba743f_arm64 |
| Red Hat | openshift-logging/logging-loki-rhel9@sha256:c48d43f0a1db7196656f8f71fed383248131117517566034f6e6e9cb67d86695_arm64 as a component of RHOL 6.0 for RHEL 9 | *, *, openshift-logging/logging-loki-rhel9@sha256:c48d43f0a1db7196656f8f71fed383248131117517566034f6e6e9cb67d86695_arm64 |
| Red Hat | openshift-logging/loki-rhel9-operator@sha256:d00ee0e4b81200dfab6367e297578feee0312f7f9304b1fe9b0e4ed89da6869a_amd64 as a component of RHOL 6.0 for RHEL 9 | openshift-logging/loki-rhel9-operator@sha256:d00ee0e4b81200dfab6367e297578feee0312f7f9304b1fe9b0e4ed89da6869a_amd64, openshift-logging/loki-rhel9-operator@sha256:d00ee0e4b81200dfab6367e297578feee0312f7f9304b1fe9b0e4ed89da6869a_amd64, openshift-logging/loki-rhel9-operator@sha256:d00ee0e4b81200dfab6367e297578feee0312f7f9304b1fe9b0e4ed89da6869a_amd64 |
| Red Hat | openshift-logging/loki-operator-bundle@sha256:951ccbeab60a7da52e6b0eed760a3b77530f5b55fe808be4ab2efa679be373b2_amd64 as a component of RHOL 6.0 for RHEL 9 | *, *, * |
| Red Hat | openshift-logging/eventrouter-rhel9@sha256:6fc3e68cc69f8ce6eb93244fc344260b48ac68794da1ce78aeb4fad606576789_arm64 as a component of RHOL 6.0 for RHEL 9 | openshift-logging/eventrouter-rhel9@sha256:6fc3e68cc69f8ce6eb93244fc344260b48ac68794da1ce78aeb4fad606576789_arm64, openshift-logging/eventrouter-rhel9@sha256:6fc3e68cc69f8ce6eb93244fc344260b48ac68794da1ce78aeb4fad606576789_arm64, openshift-logging/eventrouter-rhel9@sha256:6fc3e68cc69f8ce6eb93244fc344260b48ac68794da1ce78aeb4fad606576789_arm64 |
| Red Hat | openshift-logging/loki-operator-bundle@sha256:951ccbeab60a7da52e6b0eed760a3b77530f5b55fe808be4ab2efa679be373b2_amd64 as a component of RHOL 6.0 for RHEL 9 | openshift-logging/loki-operator-bundle@sha256:951ccbeab60a7da52e6b0eed760a3b77530f5b55fe808be4ab2efa679be373b2_amd64, openshift-logging/loki-operator-bundle@sha256:951ccbeab60a7da52e6b0eed760a3b77530f5b55fe808be4ab2efa679be373b2_amd64, openshift-logging/loki-operator-bundle@sha256:951ccbeab60a7da52e6b0eed760a3b77530f5b55fe808be4ab2efa679be373b2_amd64 |
| Red Hat | openshift-logging/log-file-metric-exporter-rhel9@sha256:e5fdace6353f81300d3fbf57d89ec1ea5038afdb2120cb0c524ce61d65424e34_ppc64le as a component of RHOL 6.0 for RHEL 9 | openshift-logging/log-file-metric-exporter-rhel9@sha256:e5fdace6353f81300d3fbf57d89ec1ea5038afdb2120cb0c524ce61d65424e34_ppc64le, *, openshift-logging/log-file-metric-exporter-rhel9@sha256:e5fdace6353f81300d3fbf57d89ec1ea5038afdb2120cb0c524ce61d65424e34_ppc64le |
| Red Hat | openshift-logging/vector-rhel9@sha256:4e73489bf07ff3376c3947f769902acfc206c6f3ed00cfd7f724f4022be97b44_ppc64le as a component of RHOL 6.0 for RHEL 9 | openshift-logging/vector-rhel9@sha256:4e73489bf07ff3376c3947f769902acfc206c6f3ed00cfd7f724f4022be97b44_ppc64le, openshift-logging/vector-rhel9@sha256:4e73489bf07ff3376c3947f769902acfc206c6f3ed00cfd7f724f4022be97b44_ppc64le, openshift-logging/vector-rhel9@sha256:4e73489bf07ff3376c3947f769902acfc206c6f3ed00cfd7f724f4022be97b44_ppc64le |
…and 48 more
Timeline
- Apr 16, 2025 CVE Published
- May 4, 2026 Distribution Patch
- May 4, 2026 Security Advisory
- May 5, 2026 Security Advisory
- May 10, 2026 Distribution Patch
- May 16, 2026 CVE Updated
References
- https://pkg.go.dev/vuln/GO-2025-3553 advisory
- https://issues.redhat.com/browse/LOG-6990 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://access.redhat.com/errata/RHSA-2025:3905 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-30204 advisory
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp advisory
- https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-30204 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3905.json advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 advisory