MicahParks jwkset up to 0.5.x Setting operation after expiration

Summaryinfo

A vulnerability was found in MicahParks jwkset up to 0.5.x and classified as problematic. This vulnerability affects unknown code of the component Setting Handler. Such manipulation leads to operation after expiration. This vulnerability is listed as CVE-2025-22149. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in MicahParks jwkset up to 0.5.x. Affected by this issue is an unknown code of the component Setting Handler. The manipulation with an unknown input leads to a operation after expiration vulnerability. Using CWE to declare the problem leads to CWE-672. The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked. Impacted is integrity. CVE summarizes:

JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal from a JWK Set is equivalent to revocation. The affected auto-caching HTTP client was added in version v0.5.0 and fixed in v0.6.0. The only workaround would be to remove the provided auto-caching HTTP client and replace it with a custom implementation. This involves setting the HTTPClientStorageOptions.RefreshInterval to zero (or not specifying the value).

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-22149 since 12/30/2024. The exploitation is known to be difficult. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 214906 (SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0297-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.6.0 eliminates this vulnerability. Applying the patch 01db49a90f7f20c7fb39a699a2f19a7a5f379ed3 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (214906). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• MicahParks

Name

• jwkset

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5

License

• open-source

Website

• Product: https://github.com/MicahParks/jwkset/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion