CVE-2025-22149 Details
Description
JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal from a JWK Set is equivalent to revocation. The affected auto-caching HTTP client was added in version v0.5.0 and fixed in v0.6.0. The only workaround would be to remove the provided auto-caching HTTP client and replace it with a custom implementation. This involves setting the HTTPClientStorageOptions.RefreshInterval to zero (or not specifying the value).
A vulnerability exists in the JWK Set Go implementation, specifically in versions 0.5.0 prior to 0.6.0. The issue arises in the HTTP client's local JWK Set cache, which fails to properly replace cached keys during refresh operations. Instead of removing or fully replacing outdated keys, the current method either overwrites or appends, creating a risk of using stale or revoked keys. This flaw is particularly concerning for applications that rely on the auto-caching HTTP client and treat key removal as an immediate revocation.
Upgrade the JWK Set library to version 0.6.0 or later. If an immediate upgrade is not possible, remove the auto-caching HTTP client and replace it with a custom implementation that disables the refresh interval.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 9, 2025CISA-ADP
Assessed Jan 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.vicarius.io/vsociety/posts/cve-2025-22149-detect-jwkset-vulnerability-in-go-projects-1 | CVE | ExploitTechnical Description |
| https://www.vicarius.io/vsociety/posts/cve-2025-22149-mitigate-jwkset-vulnerability-in-go-projects | CVE | RemedyTechnical Description |
| https://github.com/MicahParks/jwkset/commit/01db49a90f7f20c7fb39a699a2f19a7a5f379ed3 | [email protected] | Source CodeVendor |
| https://github.com/MicahParks/jwkset/issues/40 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/MicahParks/jwkset/security/advisories/GHSA-675f-rq2r-jw82 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-672 | Operation on a Resource after Expiration or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github.com/MicahParks/jwkset | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 23, 2025 | CVE Modified | CVE |
| Jan 9, 2025 | New CVE Received | [email protected] |