GHSA-mh63-6h87-95cp jwt-go allows excessive memory allocation during header parsing

• Go github.com/golang-jwt/jwt/v5: >= 5.0.0-rc.1, < 5.2.2 → fixed in 5.2.2 • Go github.com/golang-jwt/jwt/v4: < 4.5.2 → fixed in 4.5.2 • Go github.com/golang-jwt/jwt: >= 3.2.0, <= 3.2.2 (no fix yet)

Summary Function `parse.ParseUnverified` currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose _Authorization_ header consists of `Bearer ` followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification) Details See `parse.ParseUnverified` Impact Excessive memory allocation