CVE-2025-30204: golang-jwt DoS Vulnerability Alert

CVE-2025-30204 Overview

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. A malicious request with an Authorization header that contains "Bearer " followed by numerous periods results in allocations to the tune of O(n) bytes, where n stands for the length of the function's argument, with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.

Critical Impact
Denial of Service due to resource exhaustion

Affected Products

golang-jwt 3.2.0
golang-jwt 4.0.0 to 4.5.2
golang-jwt 5.0.0 to 5.2.2

Discovery Timeline

Not Available - Vulnerability discovered by Not Available
Not Available - Responsible disclosure to Not Available
Not Available - CVE CVE-2025-30204 assigned
Not Available - Not Available releases security patch
2025-03-21 - CVE CVE-2025-30204 published to NVD
2025-04-10 - Last updated in NVD database

Technical Details for CVE-2025-30204

Vulnerability Analysis

The vulnerability arises from the inefficient handling of unexpected input in the parse.ParseUnverified function. It leads to excessive memory allocation due to repeated splitting of a crafted JWT payload.

Root Cause

The root cause is the improper use of strings.Split on untrusted input, leading to unbounded memory allocations.

Attack Vector

Malicious network requests containing JWT tokens with numerous period characters in the Authorization header can exploit this vulnerability.

// Example exploitation code (sanitized)
package main

import (
    "strings"
    "fmt"
)

func main() {
    token := strings.Repeat(".", 1000000) // Large input for testing
    parts := strings.Split(token, ".")
    fmt.Println("Parts count:", len(parts))
}

Detection Methods for CVE-2025-30204

Indicators of Compromise

High memory usage by applications using golang-jwt
Frequent crashes or slow response times in JWT-related services
Unusual log patterns showing JWTs with repetitive periods

Detection Strategies

Implementing application-level monitoring to detect unexpected spikes in memory usage or response times. Analyze logs for abnormal patterns in JWT structures.

Monitoring Recommendations

Utilize application performance management tools to establish baselines and alert on anomalies related to JWT processing.

How to Mitigate CVE-2025-30204

Immediate Actions Required

Upgrade the golang-jwt library to version 5.2.2 or 4.5.2
Validate the structure of JWTs before processing them
Implement rate limiting and input filtering for JWT endpoints

Patch Information

Refer to GitHub commits for patch details and fixes applied.

Workarounds

Implement input sanitation to check and reject JWTs with excessive periods prior to processing.

bash

# Configuration example
govalidate() {
    local token="$1"
    local period_count=$(grep -o '\.' <<< "$token" | wc -l)
    if [ "$period_count" -gt 3 ]; then
      echo "Invalid token: too many segments"
      return 1
    fi
    return 0
}