The vulnerability CVE-2025-30204 affects the golang-jwt library used in the boring-registry-fips package. It allows an attacker to send a malicious request with a specially crafted Authorization header that triggers excessive memory allocation during JWT header parsing. This asymmetric resource consumption can cause denial of service through performance degradation or application crashes. The issue is tracked under CWE-405 (Asymmetric Resource Consumption) and CWE-362 (Race Condition). Red Hat has issued a security advisory and released version 0.15.5-r2 of boring-registry-fips to fix this vulnerability. The affected versions are those prior to 0.15.5-r2.

Exploitation of this vulnerability can cause denial of service by exhausting system resources such as memory and CPU, leading to significant performance degradation or application crashes. There is no impact on confidentiality or integrity reported. The vulnerability can be triggered remotely without authentication.

A patch is available in boring-registry-fips version 0.15.5-r2. Red Hat recommends updating to this fixed version. Currently, Red Hat Product Security does not provide any alternative mitigation measures. Applying the official update is the primary remediation.