VDB
RHSA-2026%3A2155
RHSA-2026%3A2155
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:cb111389ae9b1be69856acc42d0ac8ae7bba9e439460d75e416f35f30df6b349_s390x as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:cb111389ae9b1be69856acc42d0ac8ae7bba9e439460d75e416f35f30df6b349_s390x, *, * |
| Red Hat | registry.redhat.io/odf4/odf-rhel9-operator@sha256:150e1055161305e2ad8ad10ff9ea50037553946c5b77d31d31b4bf3029c47429_ppc64le as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odf-rhel9-operator@sha256:150e1055161305e2ad8ad10ff9ea50037553946c5b77d31d31b4bf3029c47429_ppc64le, registry.redhat.io/odf4/odf-rhel9-operator@sha256:150e1055161305e2ad8ad10ff9ea50037553946c5b77d31d31b4bf3029c47429_ppc64le, registry.redhat.io/odf4/odf-rhel9-operator@sha256:150e1055161305e2ad8ad10ff9ea50037553946c5b77d31d31b4bf3029c47429_ppc64le |
| Red Hat | registry.redhat.io/odf4/mcg-rhel9-operator@sha256:60aa3602cd7f640ded7db53022505c993b91429c45e6f1835a4edf45d1ed76ba_ppc64le as a component of Red Hat Openshift Data Foundation 4.17 | *, *, registry.redhat.io/odf4/mcg-rhel9-operator@sha256:60aa3602cd7f640ded7db53022505c993b91429c45e6f1835a4edf45d1ed76ba_ppc64le |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-operator-bundle@sha256:e1f7efe9dcba36adf283efa0ccf95c9081033c17558defcc4f0cf527a1b93b32_amd64 as a component of Red Hat Openshift Data Foundation 4.17 | *, registry.redhat.io/odf4/odf-csi-addons-operator-bundle@sha256:e1f7efe9dcba36adf283efa0ccf95c9081033c17558defcc4f0cf527a1b93b32_amd64, registry.redhat.io/odf4/odf-csi-addons-operator-bundle@sha256:e1f7efe9dcba36adf283efa0ccf95c9081033c17558defcc4f0cf527a1b93b32_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:004c12e61aefec1eadfa3bff6243b9c0afdd6732ae4d6d3261551b0f6075c1a3_arm64 as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:004c12e61aefec1eadfa3bff6243b9c0afdd6732ae4d6d3261551b0f6075c1a3_arm64, registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:004c12e61aefec1eadfa3bff6243b9c0afdd6732ae4d6d3261551b0f6075c1a3_arm64, registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:004c12e61aefec1eadfa3bff6243b9c0afdd6732ae4d6d3261551b0f6075c1a3_arm64 |
| Red Hat | registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:52dc31183581360f901c73453f3afded6fd8f3b130e3ba4c59c1aaa3be9ec583_amd64 as a component of Red Hat Openshift Data Foundation 4.17 | *, registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:52dc31183581360f901c73453f3afded6fd8f3b130e3ba4c59c1aaa3be9ec583_amd64, registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:52dc31183581360f901c73453f3afded6fd8f3b130e3ba4c59c1aaa3be9ec583_amd64 |
| Red Hat | registry.redhat.io/odf4/mcg-rhel9-operator@sha256:9d53bd43800e27cc3e9c4b3536cd944282068042a03e4ed158ae7ea568eb67bb_amd64 as a component of Red Hat Openshift Data Foundation 4.17 | *, registry.redhat.io/odf4/mcg-rhel9-operator@sha256:9d53bd43800e27cc3e9c4b3536cd944282068042a03e4ed158ae7ea568eb67bb_amd64, registry.redhat.io/odf4/mcg-rhel9-operator@sha256:9d53bd43800e27cc3e9c4b3536cd944282068042a03e4ed158ae7ea568eb67bb_amd64 |
| Red Hat | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:df93509dffc184bcf6eefddd397017b24ea07ce24858c790ecfacfffc91bc71c_s390x as a component of Red Hat Openshift Data Foundation 4.17 | *, registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:df93509dffc184bcf6eefddd397017b24ea07ce24858c790ecfacfffc91bc71c_s390x, registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:df93509dffc184bcf6eefddd397017b24ea07ce24858c790ecfacfffc91bc71c_s390x |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:f8aaba07e72a5ca6dce1d4df4607e737efc852334e273ce7b5c2b4cc66bfa902_amd64 as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:f8aaba07e72a5ca6dce1d4df4607e737efc852334e273ce7b5c2b4cc66bfa902_amd64, registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:f8aaba07e72a5ca6dce1d4df4607e737efc852334e273ce7b5c2b4cc66bfa902_amd64, registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:f8aaba07e72a5ca6dce1d4df4607e737efc852334e273ce7b5c2b4cc66bfa902_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:4a5a3b2eef0fd9236197fb625d61e52e0288add73b821da30cb9ce812f9bde5e_arm64 as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:4a5a3b2eef0fd9236197fb625d61e52e0288add73b821da30cb9ce812f9bde5e_arm64, registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:4a5a3b2eef0fd9236197fb625d61e52e0288add73b821da30cb9ce812f9bde5e_arm64, registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:4a5a3b2eef0fd9236197fb625d61e52e0288add73b821da30cb9ce812f9bde5e_arm64 |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:e9bd55e58f1037cf1d47efeab1befef1e4377a3fc0eebe585088dab36e85c3b5_s390x as a component of Red Hat Openshift Data Foundation 4.17 | *, *, registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:e9bd55e58f1037cf1d47efeab1befef1e4377a3fc0eebe585088dab36e85c3b5_s390x |
| Red Hat | registry.redhat.io/odf4/ocs-operator-bundle@sha256:c67bf6279d530ea4ab96ee0a30e142c33676d50961e212baa26ca08daf4fb602_amd64 as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/ocs-operator-bundle@sha256:c67bf6279d530ea4ab96ee0a30e142c33676d50961e212baa26ca08daf4fb602_amd64, registry.redhat.io/odf4/ocs-operator-bundle@sha256:c67bf6279d530ea4ab96ee0a30e142c33676d50961e212baa26ca08daf4fb602_amd64, registry.redhat.io/odf4/ocs-operator-bundle@sha256:c67bf6279d530ea4ab96ee0a30e142c33676d50961e212baa26ca08daf4fb602_amd64 |
| Red Hat | registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:36a63eadef61c38463ef5a4e823e37c3cf1fe9e679b68264cffdbb0d86edf751_s390x as a component of Red Hat Openshift Data Foundation 4.17 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odr-recipe-operator-bundle@sha256:3a93271c8df8c77b4f6f21e46e71c63e20459e49054e737a7e26f232d7ed369e_amd64 as a component of Red Hat Openshift Data Foundation 4.17 | *, registry.redhat.io/odf4/odr-recipe-operator-bundle@sha256:3a93271c8df8c77b4f6f21e46e71c63e20459e49054e737a7e26f232d7ed369e_amd64, registry.redhat.io/odf4/odr-recipe-operator-bundle@sha256:3a93271c8df8c77b4f6f21e46e71c63e20459e49054e737a7e26f232d7ed369e_amd64 |
| Red Hat | registry.redhat.io/odf4/mcg-core-rhel9@sha256:07f7d48437f0c0b9b7fe8ae2c7eed250f74b9e88fd8fd3214920ae39902b77eb_s390x as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/mcg-core-rhel9@sha256:07f7d48437f0c0b9b7fe8ae2c7eed250f74b9e88fd8fd3214920ae39902b77eb_s390x, registry.redhat.io/odf4/mcg-core-rhel9@sha256:07f7d48437f0c0b9b7fe8ae2c7eed250f74b9e88fd8fd3214920ae39902b77eb_s390x, registry.redhat.io/odf4/mcg-core-rhel9@sha256:07f7d48437f0c0b9b7fe8ae2c7eed250f74b9e88fd8fd3214920ae39902b77eb_s390x |
| Red Hat | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:5fefab6686f1f7e8437046c423d8352bac77cbda83f42e65072030d4ba48a6a4_s390x as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:5fefab6686f1f7e8437046c423d8352bac77cbda83f42e65072030d4ba48a6a4_s390x, *, registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:5fefab6686f1f7e8437046c423d8352bac77cbda83f42e65072030d4ba48a6a4_s390x |
| Red Hat | registry.redhat.io/odf4/odf-rhel9-operator@sha256:97ffe1ca43a7bbcf3c930a09f5d508c7943c78172ae8f0e1b237440b9db7d71d_arm64 as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odf-rhel9-operator@sha256:97ffe1ca43a7bbcf3c930a09f5d508c7943c78172ae8f0e1b237440b9db7d71d_arm64, registry.redhat.io/odf4/odf-rhel9-operator@sha256:97ffe1ca43a7bbcf3c930a09f5d508c7943c78172ae8f0e1b237440b9db7d71d_arm64, registry.redhat.io/odf4/odf-rhel9-operator@sha256:97ffe1ca43a7bbcf3c930a09f5d508c7943c78172ae8f0e1b237440b9db7d71d_arm64 |
| Red Hat | registry.redhat.io/odf4/odr-rhel9-operator@sha256:89f858e1635210eb377635f6318135c9cf0a317037f3872a582991318eab60e9_s390x as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odr-rhel9-operator@sha256:89f858e1635210eb377635f6318135c9cf0a317037f3872a582991318eab60e9_s390x, *, registry.redhat.io/odf4/odr-rhel9-operator@sha256:89f858e1635210eb377635f6318135c9cf0a317037f3872a582991318eab60e9_s390x |
| Red Hat | registry.redhat.io/odf4/odr-hub-operator-bundle@sha256:5088161a31edd247d796ee31907f99b2189b9cd1a83f212701616f18876cd871_amd64 as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odr-hub-operator-bundle@sha256:5088161a31edd247d796ee31907f99b2189b9cd1a83f212701616f18876cd871_amd64, *, * |
| Red Hat | registry.redhat.io/odf4/odf-rhel9-operator@sha256:0e7d8e893c52250ba821a250d7532d5e5a6c3e5ff1ddf439cf7b78d715738a16_s390x as a component of Red Hat Openshift Data Foundation 4.17 | registry.redhat.io/odf4/odf-rhel9-operator@sha256:0e7d8e893c52250ba821a250d7532d5e5a6c3e5ff1ddf439cf7b78d715738a16_s390x, *, registry.redhat.io/odf4/odf-rhel9-operator@sha256:0e7d8e893c52250ba821a250d7532d5e5a6c3e5ff1ddf439cf7b78d715738a16_s390x |
…and 141 more
Timeline
- Feb 5, 2026 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- May 28, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:2155 advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 advisory
- https://access.redhat.com/security/cve/CVE-2025-47907 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2155.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://www.cve.org/CVERecord?id=CVE-2025-30204 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-30204 advisory
- https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 advisory
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp advisory
- https://pkg.go.dev/vuln/GO-2025-3553 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2387083 issue
- https://www.cve.org/CVERecord?id=CVE-2025-47907 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47907 advisory
- https://go.dev/cl/693735 advisory
- https://go.dev/issue/74831 advisory
- https://groups.google.com/g/golang-announce/c/x5MKroML2yM advisory
- https://pkg.go.dev/vuln/GO-2025-3849 advisory