# CVE-2025-30204: grafana: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB

CVE-2025-30204 is fixed in 19 products on 1 platform, first by RHSA-2025:7475, released March 21, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-30204
- Priority: High
- CVSS: 7.5 (important)
- EPSS: 0.0081
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 21, 2025

## Description

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.     Security Fix(es):      * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)   For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | amazon-cloudwatch-agent amzn 2023 | 1.300054.1-2.amzn2023 | [ALAS2023-2025-968](https://patchblox.com/security/data/fix/linux/alas2023-2025-968.md) | May 7, 2025 |
| Linux | amber-cli opensuse-leap 15.6 | 1.13.1+git20250329.c2e3bb8-150600.3.3.1 | [SUSE-SU-2025:02769-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02769-1.md) | Aug 12, 2025 |
| Linux | amber-cli sles 15.6 | 1.13.1+git20250329.c2e3bb8-150600.3.3.1 | [SUSE-SU-2025:02769-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02769-1.md) | Aug 12, 2025 |
| Linux | amber-cli sles 15.7 | 1.13.1+git20250329.c2e3bb8-150600.3.3.1 | [SUSE-SU-2025:02769-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02769-1.md) | Aug 12, 2025 |
| Linux | ceph RHEL 10 | 20.1.0-144.el10cp | [RHSA-2026:1536](https://patchblox.com/security/data/fix/linux/rhsa-2026-1536.md) | Jan 20, 2026 |
| Linux | docker amzn 2023 | 25.0.8-1.amzn2023.0.3 | [ALAS2023-2025-945](https://patchblox.com/security/data/fix/linux/alas2023-2025-945.md) | Apr 23, 2025 |
| Linux | docker-debuginfo amzn 2023 | 25.0.8-1.amzn2023.0.3 | [ALAS2023-2025-945](https://patchblox.com/security/data/fix/linux/alas2023-2025-945.md) | Apr 23, 2025 |
| Linux | docker-debugsource amzn 2023 | 25.0.8-1.amzn2023.0.3 | [ALAS2023-2025-945](https://patchblox.com/security/data/fix/linux/alas2023-2025-945.md) | Apr 23, 2025 |
| Linux | docker-stable opensuse-leap 15.6 | 24.0.9_ce-150000.1.39.1 | [SUSE-SU-2026:0972-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0972-1.md) | Mar 23, 2026 |
| Linux | docker-stable opensuse-leap 16.0 | 24.0.9_ce-160000.4.1 | [OPENSUSE-SU-2026:20366-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20366-1.md) | Mar 16, 2026 |
| Linux | docker-stable sles 15.6 | 24.0.9_ce-150000.1.36.1 | [SUSE-SU-2026:0659-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0659-1.md) | Feb 26, 2026 |
| Linux | docker-stable sles 15.7 | 24.0.9_ce-150000.1.39.1 | [SUSE-SU-2026:0972-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0972-1.md) | Mar 23, 2026 |
| Linux | etcd opensuse-leap 15.6 | 3.5.21-150000.7.12.1 | [SUSE-SU-2025:1285-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1285-1.md) | Apr 15, 2025 |
| Linux | golang-github-golang-jwt-jwt Debian 13.5 (trixie) | 5.0.0+really4.5.2-1 | [DEBIAN-CVE-2025-30204](https://patchblox.com/security/data/fix/linux/debian-cve-2025-30204.md) | Mar 21, 2025 |
| Linux | golang-github-golang-jwt-jwt Debian 14 | 5.0.0+really4.5.2-1 | [DEBIAN-CVE-2025-30204](https://patchblox.com/security/data/fix/linux/debian-cve-2025-30204.md) | Mar 21, 2025 |
| Linux | golang-github-golang-jwt-jwt-v5 Debian 13.5 (trixie) | 5.2.2-1 | [DEBIAN-CVE-2025-30204](https://patchblox.com/security/data/fix/linux/debian-cve-2025-30204.md) | Mar 21, 2025 |
| Linux | golang-github-golang-jwt-jwt-v5 Debian 14 | 5.2.2-1 | [DEBIAN-CVE-2025-30204](https://patchblox.com/security/data/fix/linux/debian-cve-2025-30204.md) | Mar 21, 2025 |
| Linux | grafana RHEL 10 | 10.2.6-15.el10_0 | [RHSA-2025:7475](https://patchblox.com/security/data/fix/linux/rhsa-2025-7475.md) | Mar 21, 2025 |
| Linux | grafana RHEL 9 | 0:10.2.6-11.el9_6 | [RHSA-2025:7404](https://patchblox.com/security/data/fix/linux/rhsa-2025-7404.md) | May 13, 2025 |
| Linux | grafana almalinux 10 | 10.2.6-15.el10_0 | [ALSA-2025:7475](https://patchblox.com/security/data/fix/linux/alsa-2025-7475.md) | May 13, 2025 |
| Linux | grafana almalinux 9 | 10.2.6-11.el9_6 | [ALSA-2025:7404](https://patchblox.com/security/data/fix/linux/alsa-2025-7404.md) | May 13, 2025 |
| Linux | grafana ol 10 | 0:10.2.6-18.el10_0 | [ELSA-2025-7475](https://patchblox.com/security/data/fix/linux/elsa-2025-7475.md) | Jun 30, 2025 |
| Linux | grafana ol 9 | 0:10.2.6-9.el9_5 | [ELSA-2025-3344](https://patchblox.com/security/data/fix/linux/elsa-2025-3344.md) | Mar 27, 2025 |
| Linux | grafana rocky 9 | 0:10.2.6-9.el9_5 | [RLSA-2025:3344](https://patchblox.com/security/data/fix/linux/rlsa-2025-3344.md) | Jul 29, 2025 |
| Linux | grafana-selinux RHEL 9 | 0:10.2.6-11.el9_6 | [RHSA-2025:7404](https://patchblox.com/security/data/fix/linux/rhsa-2025-7404.md) | May 13, 2025 |
| Linux | grafana-selinux almalinux 10 | 10.2.6-15.el10_0 | [ALSA-2025:7475](https://patchblox.com/security/data/fix/linux/alsa-2025-7475.md) | May 13, 2025 |
| Linux | grafana-selinux almalinux 9 | 10.2.6-11.el9_6 | [ALSA-2025:7404](https://patchblox.com/security/data/fix/linux/alsa-2025-7404.md) | May 13, 2025 |
| Linux | grafana-selinux ol 10 | 0:10.2.6-18.el10_0 | [ELSA-2025-7475](https://patchblox.com/security/data/fix/linux/elsa-2025-7475.md) | Jun 30, 2025 |
| Linux | grafana-selinux ol 9 | 0:10.2.6-9.el9_5 | [ELSA-2025-3344](https://patchblox.com/security/data/fix/linux/elsa-2025-3344.md) | Mar 27, 2025 |
| Linux | opentelemetry-collector RHEL 10 | 0.107.0-9.el10_0 | [RHSA-2025:7479](https://patchblox.com/security/data/fix/linux/rhsa-2025-7479.md) | Mar 21, 2025 |
| Linux | opentelemetry-collector RHEL 9 | 0:0.107.0-8.el9_6 | [RHSA-2025:7407](https://patchblox.com/security/data/fix/linux/rhsa-2025-7407.md) | May 13, 2025 |
| Linux | opentelemetry-collector rocky 10 | 0:0.107.0-9.el10_0 | [RLSA-2025:7479](https://patchblox.com/security/data/fix/linux/rlsa-2025-7479.md) | Oct 3, 2025 |
| Linux | opentelemetry-collector rocky 9 | 0:0.107.0-10.el9_5 | [RLSA-2025:3411](https://patchblox.com/security/data/fix/linux/rlsa-2025-3411.md) | Jul 29, 2025 |
| Linux | osbuild-composer RHEL 10 | 134.1-1.el10_0 | [RHSA-2025:7503](https://patchblox.com/security/data/fix/linux/rhsa-2025-7503.md) | Mar 21, 2025 |
| Linux | osbuild-composer RHEL 8 | 0:101-3.el8_10 | [RHSA-2025:7967](https://patchblox.com/security/data/fix/linux/rhsa-2025-7967.md) | May 19, 2025 |
| Linux | osbuild-composer RHEL 9 | 0:132.2-1.el9_6 | [RHSA-2025:7425](https://patchblox.com/security/data/fix/linux/rhsa-2025-7425.md) | May 13, 2025 |
| Linux | osbuild-composer almalinux 8 | 101-3.el8_10.alma.1 | [ALSA-2025:7967](https://patchblox.com/security/data/fix/linux/alsa-2025-7967.md) | May 19, 2025 |
| Linux | osbuild-composer almalinux 9 | 132.2-1.el9_6.alma.1 | [ALSA-2025:7425](https://patchblox.com/security/data/fix/linux/alsa-2025-7425.md) | May 13, 2025 |
| Linux | osbuild-composer ol 10 | 0:134.1-2.0.1.el10_0 | [ELSA-2025-7503](https://patchblox.com/security/data/fix/linux/elsa-2025-7503.md) | Jul 1, 2025 |
| Linux | osbuild-composer ol 8 | 0:101-3.0.1.el8_10 | [ELSA-2025-7967](https://patchblox.com/security/data/fix/linux/elsa-2025-7967.md) | May 20, 2025 |
| Linux | osbuild-composer ol 9 | 0:118.2-1.0.1.el9_5 | [ELSA-2025-4669](https://patchblox.com/security/data/fix/linux/elsa-2025-4669.md) | May 8, 2025 |
| Linux | osbuild-composer rocky 8 | 0:101-3.el8_10.rocky.0.6 | [RLSA-2025:7967](https://patchblox.com/security/data/fix/linux/rlsa-2025-7967.md) | May 21, 2026 |
| Linux | osbuild-composer-core RHEL 8 | 0:101-3.el8_10 | [RHSA-2025:7967](https://patchblox.com/security/data/fix/linux/rhsa-2025-7967.md) | May 19, 2025 |
| Linux | osbuild-composer-core RHEL 9 | 0:132.2-1.el9_6 | [RHSA-2025:7425](https://patchblox.com/security/data/fix/linux/rhsa-2025-7425.md) | May 13, 2025 |
| Linux | osbuild-composer-core almalinux 8 | 101-3.el8_10.alma.1 | [ALSA-2025:7967](https://patchblox.com/security/data/fix/linux/alsa-2025-7967.md) | May 19, 2025 |
| Linux | osbuild-composer-core almalinux 9 | 132.2-1.el9_6.alma.1 | [ALSA-2025:7425](https://patchblox.com/security/data/fix/linux/alsa-2025-7425.md) | May 13, 2025 |
| Linux | osbuild-composer-core ol 10 | 0:134.1-2.0.1.el10_0 | [ELSA-2025-7503](https://patchblox.com/security/data/fix/linux/elsa-2025-7503.md) | Jul 1, 2025 |
| Linux | osbuild-composer-core ol 8 | 0:101-3.0.1.el8_10 | [ELSA-2025-7967](https://patchblox.com/security/data/fix/linux/elsa-2025-7967.md) | May 20, 2025 |
| Linux | osbuild-composer-core ol 9 | 0:118.2-1.0.1.el9_5 | [ELSA-2025-4669](https://patchblox.com/security/data/fix/linux/elsa-2025-4669.md) | May 8, 2025 |
| Linux | osbuild-composer-worker RHEL 8 | 0:101-3.el8_10 | [RHSA-2025:7967](https://patchblox.com/security/data/fix/linux/rhsa-2025-7967.md) | May 19, 2025 |
| Linux | osbuild-composer-worker RHEL 9 | 0:132.2-1.el9_6 | [RHSA-2025:7425](https://patchblox.com/security/data/fix/linux/rhsa-2025-7425.md) | May 13, 2025 |
| Linux | osbuild-composer-worker almalinux 8 | 101-3.el8_10.alma.1 | [ALSA-2025:7967](https://patchblox.com/security/data/fix/linux/alsa-2025-7967.md) | May 19, 2025 |
| Linux | osbuild-composer-worker almalinux 9 | 132.2-1.el9_6.alma.1 | [ALSA-2025:7425](https://patchblox.com/security/data/fix/linux/alsa-2025-7425.md) | May 13, 2025 |
| Linux | osbuild-composer-worker ol 10 | 0:134.1-2.0.1.el10_0 | [ELSA-2025-7503](https://patchblox.com/security/data/fix/linux/elsa-2025-7503.md) | Jul 1, 2025 |
| Linux | osbuild-composer-worker ol 8 | 0:101-3.0.1.el8_10 | [ELSA-2025-7967](https://patchblox.com/security/data/fix/linux/elsa-2025-7967.md) | May 20, 2025 |
| Linux | osbuild-composer-worker ol 9 | 0:118.2-1.0.1.el9_5 | [ELSA-2025-4669](https://patchblox.com/security/data/fix/linux/elsa-2025-4669.md) | May 8, 2025 |
| Linux | rekor opensuse-leap 15.6 | 1.3.10-150400.4.25.1 | [SUSE-SU-2025:1332-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1332-1.md) | Apr 17, 2025 |
| Linux | rekor sles 15.6 | 1.3.10-150400.4.25.1 | [SUSE-SU-2025:1332-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1332-1.md) | Apr 17, 2025 |
| Linux | runfinch-finch amzn 2023 | 1.7.2-1.amzn2023.0.1 | [ALAS2023-2025-944](https://patchblox.com/security/data/fix/linux/alas2023-2025-944.md) | Apr 23, 2025 |
| Linux | vexctl opensuse-leap 15.6 | 0.4.1+git78.f951e3a-150000.1.11.1 | [SUSE-SU-2026:0592-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0592-1.md) | Feb 20, 2026 |
| Linux | vexctl opensuse-leap 16.0 | 0.4.4+git20.5d61136-160000.1.1 | [OPENSUSE-SU-2026:21481-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21481-1.md) | Jul 30, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.