VDB
RHSA-2025%3A8542
RHSA-2025%3A8542
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/insights-client-rhel9@sha256:7e601373dde8fb58278f0fc3b0a4f4ed78282a82212f514cef523fc13b6c3e7a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | *, rhacm2/insights-client-rhel9@sha256:7e601373dde8fb58278f0fc3b0a4f4ed78282a82212f514cef523fc13b6c3e7a_amd64, rhacm2/insights-client-rhel9@sha256:7e601373dde8fb58278f0fc3b0a4f4ed78282a82212f514cef523fc13b6c3e7a_amd64 |
| Red Hat | rhacm2/multicluster-observability-rhel9-operator@sha256:644fc46c77083e36ba6e5912b32eaf9ea89889af35766ede6e551f4fe825d624_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/multicluster-observability-rhel9-operator@sha256:644fc46c77083e36ba6e5912b32eaf9ea89889af35766ede6e551f4fe825d624_arm64, *, rhacm2/multicluster-observability-rhel9-operator@sha256:644fc46c77083e36ba6e5912b32eaf9ea89889af35766ede6e551f4fe825d624_arm64 |
| Red Hat | rhacm2/observatorium-rhel9@sha256:56d5c51bc157623fda6df2c6d79a4a7ab9d7db1cd1ccb0ab16c1bbce5681e593_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | *, rhacm2/observatorium-rhel9@sha256:56d5c51bc157623fda6df2c6d79a4a7ab9d7db1cd1ccb0ab16c1bbce5681e593_amd64, rhacm2/observatorium-rhel9@sha256:56d5c51bc157623fda6df2c6d79a4a7ab9d7db1cd1ccb0ab16c1bbce5681e593_amd64 |
| Red Hat | rhacm2/multicloud-integrations-rhel9@sha256:56c622eaa7d2a8d3a8874d329582f867896ec11d4423a21203ec9d0c9074d07b_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | *, rhacm2/multicloud-integrations-rhel9@sha256:56c622eaa7d2a8d3a8874d329582f867896ec11d4423a21203ec9d0c9074d07b_amd64, rhacm2/multicloud-integrations-rhel9@sha256:56c622eaa7d2a8d3a8874d329582f867896ec11d4423a21203ec9d0c9074d07b_amd64 |
| Red Hat | rhacm2/acm-volsync-addon-controller-rhel9@sha256:1e791949b6de55031a5db2a1e6e6ffcccae5023ec6ef3efca21d5d71a820292c_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/acm-volsync-addon-controller-rhel9@sha256:1e791949b6de55031a5db2a1e6e6ffcccae5023ec6ef3efca21d5d71a820292c_arm64, rhacm2/acm-volsync-addon-controller-rhel9@sha256:1e791949b6de55031a5db2a1e6e6ffcccae5023ec6ef3efca21d5d71a820292c_arm64, rhacm2/acm-volsync-addon-controller-rhel9@sha256:1e791949b6de55031a5db2a1e6e6ffcccae5023ec6ef3efca21d5d71a820292c_arm64 |
| Red Hat | rhacm2/acm-prometheus-config-reloader-rhel9@sha256:74aa550dfef088488adbeb5306b79f7095794877633f1de68607c3237ac24d8e_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/acm-prometheus-config-reloader-rhel9@sha256:74aa550dfef088488adbeb5306b79f7095794877633f1de68607c3237ac24d8e_s390x, rhacm2/acm-prometheus-config-reloader-rhel9@sha256:74aa550dfef088488adbeb5306b79f7095794877633f1de68607c3237ac24d8e_s390x, rhacm2/acm-prometheus-config-reloader-rhel9@sha256:74aa550dfef088488adbeb5306b79f7095794877633f1de68607c3237ac24d8e_s390x |
| Red Hat | rhacm2/insights-metrics-rhel9@sha256:159b233be49c57e8478782dd20753fee0cf94d21228b838d6f7941fbe9eb4593_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/insights-metrics-rhel9@sha256:159b233be49c57e8478782dd20753fee0cf94d21228b838d6f7941fbe9eb4593_arm64, rhacm2/insights-metrics-rhel9@sha256:159b233be49c57e8478782dd20753fee0cf94d21228b838d6f7941fbe9eb4593_arm64, rhacm2/insights-metrics-rhel9@sha256:159b233be49c57e8478782dd20753fee0cf94d21228b838d6f7941fbe9eb4593_arm64 |
| Red Hat | rhacm2/node-exporter-rhel9@sha256:f11dfc23596db038c2608b63e4b20a1f97eede4d277b81241127afbea1d32bb7_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/acm-volsync-addon-controller-rhel9@sha256:1e791949b6de55031a5db2a1e6e6ffcccae5023ec6ef3efca21d5d71a820292c_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/acm-volsync-addon-controller-rhel9@sha256:1e791949b6de55031a5db2a1e6e6ffcccae5023ec6ef3efca21d5d71a820292c_arm64, rhacm2/acm-volsync-addon-controller-rhel9@sha256:1e791949b6de55031a5db2a1e6e6ffcccae5023ec6ef3efca21d5d71a820292c_arm64, rhacm2/acm-volsync-addon-controller-rhel9@sha256:1e791949b6de55031a5db2a1e6e6ffcccae5023ec6ef3efca21d5d71a820292c_arm64 |
| Red Hat | rhacm2/acm-search-v2-rhel9@sha256:ce897a51d1734dea7fe8d9f11e63cb679975a607709364e1ee951a09673fce79_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/acm-search-v2-rhel9@sha256:ce897a51d1734dea7fe8d9f11e63cb679975a607709364e1ee951a09673fce79_amd64, rhacm2/acm-search-v2-rhel9@sha256:ce897a51d1734dea7fe8d9f11e63cb679975a607709364e1ee951a09673fce79_amd64, rhacm2/acm-search-v2-rhel9@sha256:ce897a51d1734dea7fe8d9f11e63cb679975a607709364e1ee951a09673fce79_amd64 |
| Red Hat | rhacm2/klusterlet-addon-controller-rhel9@sha256:f0ac21470944392e1e8193adebcfd9e1378778f5a0f15d3a5a41beb7f8d112e6_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/klusterlet-addon-controller-rhel9@sha256:f0ac21470944392e1e8193adebcfd9e1378778f5a0f15d3a5a41beb7f8d112e6_s390x, rhacm2/klusterlet-addon-controller-rhel9@sha256:f0ac21470944392e1e8193adebcfd9e1378778f5a0f15d3a5a41beb7f8d112e6_s390x, rhacm2/klusterlet-addon-controller-rhel9@sha256:f0ac21470944392e1e8193adebcfd9e1378778f5a0f15d3a5a41beb7f8d112e6_s390x |
| Red Hat | rhacm2/acm-cli-rhel9@sha256:8a53d46624d5da981a3c34455d7006a518971955a9d5ec63820899c144dec258_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/acm-cli-rhel9@sha256:8a53d46624d5da981a3c34455d7006a518971955a9d5ec63820899c144dec258_arm64, rhacm2/acm-cli-rhel9@sha256:8a53d46624d5da981a3c34455d7006a518971955a9d5ec63820899c144dec258_arm64, rhacm2/acm-cli-rhel9@sha256:8a53d46624d5da981a3c34455d7006a518971955a9d5ec63820899c144dec258_arm64 |
| Red Hat | rhacm2/acm-flightctl-api-rhel9@sha256:857166c68c80eb1ed9dab8fc3ea3428c7f9be10a3990460e403c40a470f5d291_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | *, rhacm2/acm-flightctl-api-rhel9@sha256:857166c68c80eb1ed9dab8fc3ea3428c7f9be10a3990460e403c40a470f5d291_amd64, * |
| Red Hat | rhacm2/endpoint-monitoring-rhel9-operator@sha256:fa1232afca621fd5b263d0d5cd9ec54c67765ecfcb48d6aa7cf6c6e3f1001f2e_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:e2c27f834cb29f9cf16de62e3fc5f14e60b83cb7b89b9ad3875f20937e2b3f5f_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:e2c27f834cb29f9cf16de62e3fc5f14e60b83cb7b89b9ad3875f20937e2b3f5f_ppc64le, rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:e2c27f834cb29f9cf16de62e3fc5f14e60b83cb7b89b9ad3875f20937e2b3f5f_ppc64le, rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:e2c27f834cb29f9cf16de62e3fc5f14e60b83cb7b89b9ad3875f20937e2b3f5f_ppc64le |
| Red Hat | rhacm2/kube-state-metrics-rhel9@sha256:1ddce9468845c50c87be4232e546c960b33f6a4224faa32354c944d3adc84982_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | *, rhacm2/kube-state-metrics-rhel9@sha256:1ddce9468845c50c87be4232e546c960b33f6a4224faa32354c944d3adc84982_s390x, rhacm2/kube-state-metrics-rhel9@sha256:1ddce9468845c50c87be4232e546c960b33f6a4224faa32354c944d3adc84982_s390x |
| Red Hat | rhacm2/acm-flightctl-ui-rhel9@sha256:d8be8f4d3c32e54ea302ecbb6fa512468c2acfa9f2353651cc29f96227c079b3_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/acm-flightctl-ui-rhel9@sha256:d8be8f4d3c32e54ea302ecbb6fa512468c2acfa9f2353651cc29f96227c079b3_arm64, *, rhacm2/acm-flightctl-ui-rhel9@sha256:d8be8f4d3c32e54ea302ecbb6fa512468c2acfa9f2353651cc29f96227c079b3_arm64 |
| Red Hat | rhacm2/acm-flightctl-ocp-ui-rhel9@sha256:f36aa6001094ccd5086f49738c5ea0230bd9c754309a791e079121faa1711c8e_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | *, rhacm2/acm-flightctl-ocp-ui-rhel9@sha256:f36aa6001094ccd5086f49738c5ea0230bd9c754309a791e079121faa1711c8e_arm64, rhacm2/acm-flightctl-ocp-ui-rhel9@sha256:f36aa6001094ccd5086f49738c5ea0230bd9c754309a791e079121faa1711c8e_arm64 |
| Red Hat | rhacm2/config-policy-controller-rhel9@sha256:4210913050dbe50c6df6b82127ff96842e181c61bd9e3da21c6e247687040e8b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | *, rhacm2/config-policy-controller-rhel9@sha256:4210913050dbe50c6df6b82127ff96842e181c61bd9e3da21c6e247687040e8b_ppc64le, rhacm2/config-policy-controller-rhel9@sha256:4210913050dbe50c6df6b82127ff96842e181c61bd9e3da21c6e247687040e8b_ppc64le |
| Red Hat | rhacm2/acm-grafana-rhel9@sha256:66138f22823f130185440deca16d5f2d513e7470d171c01e03214b5c40e05cfe_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | rhacm2/acm-grafana-rhel9@sha256:66138f22823f130185440deca16d5f2d513e7470d171c01e03214b5c40e05cfe_arm64, *, * |
…and 387 more
Timeline
- Jun 4, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- May 28, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:8542 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/release_notes/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://issues.redhat.com/browse/ACM-17263 advisory
- https://issues.redhat.com/browse/ACM-19579 advisory
- https://issues.redhat.com/browse/ACM-19714 advisory
- https://issues.redhat.com/browse/ACM-19926 advisory
- https://issues.redhat.com/browse/ACM-20085 advisory
- https://issues.redhat.com/browse/ACM-20600 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8542.json advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-30204 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-30204 advisory
- https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 advisory
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp advisory
- https://pkg.go.dev/vuln/GO-2025-3553 advisory