{"action":"Upgrade github.com/MicahParks/jwkset to 0.6.0 or later.","affected":[{"fixed":"0.6.0","introduced":"0.5.0"}],"component":"github.com/MicahParks/jwkset","cve_ids":["CVE-2025-22149"],"ecosystem":"Go","epss":0.00555,"exploited":false,"fixed_versions":["0.6.0"],"ghsa_id":"GHSA-675f-rq2r-jw82","id":"tcs_01M5KEZGZZF2Y6GHKCATB41YD1","modified_at":"2025-01-09T20:12:30.168789Z","published_at":"2025-01-09T17:23:43Z","references":["https://osv.dev/vulnerability/GHSA-675f-rq2r-jw82","https://github.com/MicahParks/jwkset/security/advisories/GHSA-675f-rq2r-jw82","https://nvd.nist.gov/vuln/detail/CVE-2025-22149","https://github.com/MicahParks/jwkset/issues/40","https://github.com/MicahParks/jwkset/pull/41","https://github.com/MicahParks/jwkset/commit/01db49a90f7f20c7fb39a699a2f19a7a5f379ed3","https://github.com/MicahParks/jwkset"],"severity":{"label":"low","score":2.1},"sources":[{"source":"osv","source_id":"GHSA-675f-rq2r-jw82","url":"https://osv.dev/vulnerability/GHSA-675f-rq2r-jw82"},{"source":"nvd","source_id":"CVE-2025-22149","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22149"}],"summary":"JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh"}