Vulnerability-Lookup

RHSA-2025:3344

Vulnerability from csaf_redhat - Published: 2025-03-27 15:46 - Updated: 2026-09-19 18:07

Summary

Red Hat Security Advisory: grafana security update

Severity

Important

Notes

Topic: An update for grafana is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-21613

An argument injection vulnerability was found in go-git. This flaw allows an attacker to set arbitrary values to git-upload-pack flags, leading to command or code execution, exposure of sensitive data, or other unintended behavior. This is only possible in configurations where the file transport protocol is being used.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected products

Fixed 17 products

Product	Version	Remediation
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2025-30204

A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-405 - Asymmetric Resource Consumption (Amplification)

Affected products

Fixed 17 products, the same list as for CVE-2025-21613

Threats

Impact Important

References

17 references

URL	Category
https://access.redhat.com/errata/RHSA-2025:3344	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2354195	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-21613	self
https://bugzilla.redhat.com/show_bug.cgi?id=2335888	external
https://www.cve.org/CVERecord?id=CVE-2025-21613	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21613	external
https://github.com/go-git/go-git/security/advisor…	external
https://pkg.go.dev/vuln/GO-2025-3368	external
https://access.redhat.com/security/cve/CVE-2025-30204	self
https://bugzilla.redhat.com/show_bug.cgi?id=2354195	external
https://www.cve.org/CVERecord?id=CVE-2025-30204	external
https://nvd.nist.gov/vuln/detail/CVE-2025-30204	external
https://github.com/golang-jwt/jwt/commit/0951d184…	external
https://github.com/golang-jwt/jwt/security/adviso…	external
https://pkg.go.dev/vuln/GO-2025-3553	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:3344",
        "url": "https://access.redhat.com/errata/RHSA-2025:3344"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2354195",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354195"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3344.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana security update",
    "tracking": {
      "current_release_date": "2026-09-19T18:07:23+00:00",
      "generator": {
        "date": "2026-09-19T18:07:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2025:3344",
      "initial_release_date": "2025-03-27T15:46:43+00:00",
      "revision_history": [
        {
          "date": "2025-03-27T15:46:43+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-03-27T15:46:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-19T18:07:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.5.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-9.el9_5.src",
                "product": {
                  "name": "grafana-0:10.2.6-9.el9_5.src",
                  "product_id": "grafana-0:10.2.6-9.el9_5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-9.el9_5?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-9.el9_5.aarch64",
                "product": {
                  "name": "grafana-0:10.2.6-9.el9_5.aarch64",
                  "product_id": "grafana-0:10.2.6-9.el9_5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-9.el9_5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:10.2.6-9.el9_5.aarch64",
                "product": {
                  "name": "grafana-selinux-0:10.2.6-9.el9_5.aarch64",
                  "product_id": "grafana-selinux-0:10.2.6-9.el9_5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-9.el9_5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
                "product": {
                  "name": "grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
                  "product_id": "grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-9.el9_5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
                "product": {
                  "name": "grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
                  "product_id": "grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-9.el9_5?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-9.el9_5.ppc64le",
                "product": {
                  "name": "grafana-0:10.2.6-9.el9_5.ppc64le",
                  "product_id": "grafana-0:10.2.6-9.el9_5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-9.el9_5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
                "product": {
                  "name": "grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
                  "product_id": "grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-9.el9_5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
                "product": {
                  "name": "grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
                  "product_id": "grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-9.el9_5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
                "product": {
                  "name": "grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
                  "product_id": "grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-9.el9_5?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-9.el9_5.x86_64",
                "product": {
                  "name": "grafana-0:10.2.6-9.el9_5.x86_64",
                  "product_id": "grafana-0:10.2.6-9.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-9.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:10.2.6-9.el9_5.x86_64",
                "product": {
                  "name": "grafana-selinux-0:10.2.6-9.el9_5.x86_64",
                  "product_id": "grafana-selinux-0:10.2.6-9.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-9.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
                "product": {
                  "name": "grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
                  "product_id": "grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-9.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
                "product": {
                  "name": "grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
                  "product_id": "grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-9.el9_5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-9.el9_5.s390x",
                "product": {
                  "name": "grafana-0:10.2.6-9.el9_5.s390x",
                  "product_id": "grafana-0:10.2.6-9.el9_5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-9.el9_5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:10.2.6-9.el9_5.s390x",
                "product": {
                  "name": "grafana-selinux-0:10.2.6-9.el9_5.s390x",
                  "product_id": "grafana-selinux-0:10.2.6-9.el9_5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-9.el9_5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:10.2.6-9.el9_5.s390x",
                "product": {
                  "name": "grafana-debugsource-0:10.2.6-9.el9_5.s390x",
                  "product_id": "grafana-debugsource-0:10.2.6-9.el9_5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-9.el9_5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
                "product": {
                  "name": "grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
                  "product_id": "grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-9.el9_5?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-9.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64"
        },
        "product_reference": "grafana-0:10.2.6-9.el9_5.aarch64",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-9.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le"
        },
        "product_reference": "grafana-0:10.2.6-9.el9_5.ppc64le",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-9.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x"
        },
        "product_reference": "grafana-0:10.2.6-9.el9_5.s390x",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-9.el9_5.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src"
        },
        "product_reference": "grafana-0:10.2.6-9.el9_5.src",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-9.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64"
        },
        "product_reference": "grafana-0:10.2.6-9.el9_5.x86_64",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:10.2.6-9.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64"
        },
        "product_reference": "grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le"
        },
        "product_reference": "grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:10.2.6-9.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x"
        },
        "product_reference": "grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:10.2.6-9.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64"
        },
        "product_reference": "grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:10.2.6-9.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64"
        },
        "product_reference": "grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:10.2.6-9.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le"
        },
        "product_reference": "grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:10.2.6-9.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x"
        },
        "product_reference": "grafana-debugsource-0:10.2.6-9.el9_5.s390x",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:10.2.6-9.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64"
        },
        "product_reference": "grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:10.2.6-9.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64"
        },
        "product_reference": "grafana-selinux-0:10.2.6-9.el9_5.aarch64",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:10.2.6-9.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le"
        },
        "product_reference": "grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:10.2.6-9.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x"
        },
        "product_reference": "grafana-selinux-0:10.2.6-9.el9_5.s390x",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:10.2.6-9.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64"
        },
        "product_reference": "grafana-selinux-0:10.2.6-9.el9_5.x86_64",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-21613",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2025-01-06T17:00:41.244449+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2335888"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An argument injection vulnerability was found in go-git. This flaw allows an attacker to set arbitrary values to git-upload-pack flags, leading to command or code execution, exposure of sensitive data, or other unintended behavior. This is only possible in configurations where the file transport protocol is being used.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "go-git: argument injection via the URL field",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because an argument injection has been discovered in go-git, where an attackers can manipulate git-upload-pack flags, potentially enabling command or code execution leads to an exposure of sensitive data or other unintended actions, this vulnerability occurs exclusively in configurations using the file transport protocol.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64",
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le",
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x",
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src",
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64",
          "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
          "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
          "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
          "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
          "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
          "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
          "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x",
          "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
          "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64",
          "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
          "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x",
          "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-21613"
        },
        {
          "category": "external",
          "summary": "RHBZ#2335888",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2335888"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-21613",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-21613"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-21613",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21613"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m",
          "url": "https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3368",
          "url": "https://pkg.go.dev/vuln/GO-2025-3368"
        }
      ],
      "release_date": "2025-01-06T16:13:10.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-27T15:46:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:3344"
        },
        {
          "category": "workaround",
          "details": "In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.",
          "product_ids": [
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "go-git: argument injection via the URL field"
    },
    {
      "cve": "CVE-2025-30204",
      "cwe": {
        "id": "CWE-405",
        "name": "Asymmetric Resource Consumption (Amplification)"
      },
      "discovery_date": "2025-03-21T22:00:43.818367+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2354195"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64",
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le",
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x",
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src",
          "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64",
          "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
          "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
          "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
          "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
          "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
          "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
          "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x",
          "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
          "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64",
          "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
          "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x",
          "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-30204"
        },
        {
          "category": "external",
          "summary": "RHBZ#2354195",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354195"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-30204",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-30204"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-30204",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30204"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3",
          "url": "https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp",
          "url": "https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3553",
          "url": "https://pkg.go.dev/vuln/GO-2025-3553"
        }
      ],
      "release_date": "2025-03-21T21:42:01.382000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-27T15:46:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:3344"
        },
        {
          "category": "workaround",
          "details": "Red Hat Product Security does not have a recommended mitigation at this time.",
          "product_ids": [
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.src",
            "AppStream-9.5.0.Z.MAIN:grafana-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debuginfo-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-debugsource-0:10.2.6-9.el9_5.x86_64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.aarch64",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.ppc64le",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.s390x",
            "AppStream-9.5.0.Z.MAIN:grafana-selinux-0:10.2.6-9.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    }
  ]
}

CVE-2025-21613 (GCVE-0-2025-21613)

Vulnerability from cvelistv5 – Published: 2025-01-06 16:13 – Updated: 2025-01-06 16:45

Title

go-git has an Argument Injection via the URL field

Summary

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-06 16:38 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/go-git/go-git/security/advisor…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
go-git	go-git	Affected: >= 4.0.0, < 5.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21613",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-06T16:38:34.120792Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-88",
                "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-06T16:45:02.671Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-git",
          "vendor": "go-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0,  \u003c 5.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-06T16:13:10.611Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m"
        }
      ],
      "source": {
        "advisory": "GHSA-v725-9546-7q7m",
        "discovery": "UNKNOWN"
      },
      "title": "go-git has an Argument Injection via the URL field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-21613",
    "datePublished": "2025-01-06T16:13:10.611Z",
    "dateReserved": "2024-12-29T03:00:24.713Z",
    "dateUpdated": "2025-01-06T16:45:02.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30204 (GCVE-0-2025-30204)

Vulnerability from cvelistv5 – Published: 2025-03-21 21:42 – Updated: 2025-04-10 13:03

Title

jwt-go allows excessive memory allocation during header parsing

Summary

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-24 14:10 UTC

CWE

CWE-405 - Asymmetric Resource Consumption (Amplification)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/golang-jwt/jwt/security/adviso…	x_refsource_CONFIRM
https://github.com/golang-jwt/jwt/commit/0951d184…	x_refsource_MISC
https://github.com/golang-jwt/jwt/commit/bf316c48…	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2025040…

Impacted products

1 product

Vendor	Product	Version
golang-jwt	jwt	Affected: >= 3.2.0, < 4.5.2 Affected: >= 5.0.0-rc.1, < 5.2.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30204",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-24T14:10:18.281694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-24T14:10:35.776Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-04T23:03:13.309Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250404-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jwt",
          "vendor": "golang-jwt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.2.0, \u003c 4.5.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-rc.1, \u003c 5.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer  followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function\u0027s argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-405",
              "description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-10T13:03:19.897Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp"
        },
        {
          "name": "https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3"
        },
        {
          "name": "https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb"
        }
      ],
      "source": {
        "advisory": "GHSA-mh63-6h87-95cp",
        "discovery": "UNKNOWN"
      },
      "title": "jwt-go allows excessive memory allocation during header parsing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-30204",
    "datePublished": "2025-03-21T21:42:01.382Z",
    "dateReserved": "2025-03-18T18:15:13.849Z",
    "dateUpdated": "2025-04-10T13:03:19.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:3344

CVE-2025-21613 (GCVE-0-2025-21613)

CVE-2025-30204 (GCVE-0-2025-30204)

Tags

Sightings

Nomenclature

Related by attack behaviour