Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/golang-github-dgrijalva-jwt-go@3.2.0-4?distro=bullseye
purl pkg:deb/debian/golang-github-dgrijalva-jwt-go@3.2.0-4?distro=bullseye
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-47qq-pxyn-wqge Authorization bypass in github.com/dgrijalva/jwt-go jwt-go allows attackers to bypass intended access restrictions in situations with `[]string{}` for `m["aud"]` (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to [golang-jwt](https://github.com/golang-jwt/jwt) at version 3.2.1 CVE-2020-26160
GHSA-w73w-5m7g-f7qc

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-02T05:46:35.623108+00:00 Debian Importer Fixing VCID-47qq-pxyn-wqge https://security-tracker.debian.org/tracker/data/json 38.6.0
2026-04-16T12:10:22.907800+00:00 Debian Importer Fixing VCID-47qq-pxyn-wqge https://security-tracker.debian.org/tracker/data/json 38.4.0
2026-04-13T08:19:31.054766+00:00 Debian Importer Fixing VCID-47qq-pxyn-wqge https://security-tracker.debian.org/tracker/data/json 38.3.0
2026-04-03T07:25:41.946631+00:00 Debian Importer Fixing VCID-47qq-pxyn-wqge https://security-tracker.debian.org/tracker/data/json 38.1.0