Affected: AlmaLinux:9: grafana, AlmaLinux:9: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) liste…

Withdrawn by the publisher.

Affected: CleanStart: minio-operator

Multiple security vulnerabilities affect the minio-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details.

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's ar…

Affected: Go: github.com/golang-jwt/jwt/v5, Go: github.com/golang-jwt/jwt/v4, Go: github.com/golang-jwt/jwt

### Summary

Function [`parse.ParseUnverified`](https://github.com/golang-jwt/jwt/blob/c035977d9e11c351f4c05dfeae193923cbab49ee/parser.go#L138-L139) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request whose _Authorization_…

Security update for trivy

golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

Security update for amber-cli

Affected: Ubuntu:22.04:LTS: golang-github-golang-jwt-jwt, Ubuntu:24.04:LTS: golang-github-golang-jwt-jwt, Ubuntu:24.04:LTS: golang-github-golang-jwt-jwt-v5

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header …

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Daten zu manipulieren, oder einen Denial of Service auszulösen.