{"action":"Upgrade github.com/MicahParks/jwkset to 0.6.0 or later.","affected":[{"fixed":"0.6.0","introduced":"0.5.0"}],"component":"github.com/MicahParks/jwkset","cve_ids":["CVE-2025-22149"],"ecosystem":"Go","epss":0.00555,"exploited":false,"fixed_versions":["0.6.0"],"ghsa_id":"GHSA-675f-rq2r-jw82","id":"tcs_01M5KG6K81WDWA5HW544TRSY4K","modified_at":"2026-03-03T04:56:11.703710Z","published_at":"2025-01-09T19:41:13Z","references":["https://osv.dev/vulnerability/GO-2025-3376","https://github.com/MicahParks/jwkset/security/advisories/GHSA-675f-rq2r-jw82","https://nvd.nist.gov/vuln/detail/CVE-2025-22149","https://github.com/MicahParks/jwkset/commit/01db49a90f7f20c7fb39a699a2f19a7a5f379ed3","https://github.com/MicahParks/jwkset/pull/41","https://github.com/MicahParks/jwkset/issues/40"],"severity":{"label":"low","score":2.1},"sources":[{"source":"osv","source_id":"GO-2025-3376","url":"https://osv.dev/vulnerability/GO-2025-3376"},{"source":"nvd","source_id":"CVE-2025-22149","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22149"}],"summary":"JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset"}