Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/golang-github-dgrijalva-jwt-go@3.2.0-3
purl pkg:deb/debian/golang-github-dgrijalva-jwt-go@3.2.0-3
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-47qq-pxyn-wqge Authorization bypass in github.com/dgrijalva/jwt-go jwt-go allows attackers to bypass intended access restrictions in situations with `[]string{}` for `m["aud"]` (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to [golang-jwt](https://github.com/golang-jwt/jwt) at version 3.2.1 CVE-2020-26160
GHSA-w73w-5m7g-f7qc

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-15T23:53:41.523602+00:00 Debian Oval Importer Fixing VCID-47qq-pxyn-wqge https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.4.0
2026-04-11T23:28:00.885927+00:00 Debian Oval Importer Fixing VCID-47qq-pxyn-wqge https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.3.0
2026-04-08T23:01:00.619129+00:00 Debian Oval Importer Fixing VCID-47qq-pxyn-wqge https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.1.0