Skip to content

Conversation

@KrisKennawayDD
Copy link
Contributor

@KrisKennawayDD KrisKennawayDD commented May 7, 2025

Resolves the following vulns:

┌───────────────────────────┬────────────────┬──────────┬──────────┬─────────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│          Library          │ Vulnerability  │ Severity │  Status  │  Installed Version  │ Fixed Version │                           Title                           │
├───────────────────────────┼────────────────┼──────────┼──────────┼─────────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ github.com/golang-jwt/jwt │ CVE-2025-30204 │ HIGH     │ affected │ v3.2.2+incompatible │               │ golang-jwt/jwt: jwt-go allows excessive memory allocation │
│                           │                │          │          │                     │               │ during header parsing                                     │
│                           │                │          │          │                     │               │ https://avd.aquasec.com/nvd/cve-2025-30204                │
├───────────────────────────┼────────────────┤          ├──────────┼─────────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ golang.org/x/crypto       │ CVE-2025-22869 │          │ fixed    │ v0.32.0             │ 0.35.0        │ golang.org/x/crypto/ssh: Denial of Service in the Key     │
│                           │                │          │          │                     │               │ Exchange of golang.org/x/crypto/ssh                       │
│                           │                │          │          │                     │               │ https://avd.aquasec.com/nvd/cve-2025-22869                │
├───────────────────────────┼────────────────┼──────────┤          ├─────────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ golang.org/x/net          │ CVE-2025-22870 │ MEDIUM   │          │ v0.34.0             │ 0.36.0        │ golang.org/x/net/proxy: golang.org/x/net/http/httpproxy:  │
│                           │                │          │          │                     │               │ HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net │
│                           │                │          │          │                     │               │ https://avd.aquasec.com/nvd/cve-2025-22870                │
│                           ├────────────────┤          │          │                     ├───────────────┼───────────────────────────────────────────────────────────┤
│                           │ CVE-2025-22872 │          │          │                     │ 0.38.0        │ golang.org/x/net/html: Incorrect Neutralization of Input  │
│                           │                │          │          │                     │               │ During Web Page Generation in x/net in...                 │
│                           │                │          │          │                     │               │ https://avd.aquasec.com/nvd/cve-2025-22872                │
└───────────────────────────┴────────────────┴──────────┴──────────┴─────────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant