Go/github.com/MicahParks/jwkset CVE-2025-22149: low 2.1, EPSS 0.56%
JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset
Action: Upgrade github.com/MicahParks/jwkset to 0.6.0 or later.
go get github.com/MicahParks/jwkset@v0.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.5.0 | 0.6.0 | - |
Fixed versions
| 0.6.0 |
Sources
- osv: GO-2025-3376
- nvd: CVE-2025-22149
- https://github.com/MicahParks/jwkset/security/advisories/GHSA-675f-rq2r-jw82
- https://github.com/MicahParks/jwkset/commit/01db49a90f7f20c7fb39a699a2f19a7a5f379ed3
- https://github.com/MicahParks/jwkset/pull/41
- https://github.com/MicahParks/jwkset/issues/40
CVE-2025-22149 · published · modified · JSON