CVE-2015-10004: Timing Side-Channel Vulnerability in robbert229/jwt
Summary
CVE-2015-10004: robbert229/jwt's token validation methods vulnerable to a timing side-channel during HMAC comparison. Affects github.com/robbert229/jwt versions < 0.0.0-20170426191122-ca1404ee6e83. Fixed in 0.0.0-20170426191122-ca1404ee6e83. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The robbert229/jwt package is a Go library that provides functionality for JSON Web Tokens (JWT). JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The robbert229/jwt package allows users to generate, sign, and validate JWTs. However, a vulnerability has been discovered in the token validation methods of the package, making it susceptible to a timing side-channel during HMAC comparison.
Vulnerability Detail
The vulnerability in robbert229/jwt's token validation methods allows an attacker to exploit a timing side-channel during HMAC comparison. By sending a large number of requests over a low latency connection, an attacker can analyze the timing differences in the HMAC comparison process to determine the expected HMAC. This information can be used to forge valid tokens and potentially gain unauthorized access to protected resources.
How To Fix
Latest published version: v2.0.0+incompatible as of 23 Oct 2026
go get github.com/robbert229/jwt@v2.0.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20170426191122-ca1404ee6e83
This is the first release that contains the fix.
go get github.com/robbert229/jwt@v0.0.0-20170426191122-ca1404ee6e83Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
The robbert229/jwt package is vulnerable to a timing side-channel during HMAC comparison. To mitigate this vulnerability, it is recommended to update the package to version 0.0.0-20170426191122-ca1404ee6e83 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/robbert229/jwt →
FAQ
robbert229/jwt is a Go library for working with JSON Web Tokens (JWT). It provides functionality for generating, signing, and validating JWTs.
A timing side-channel is a type of vulnerability where an attacker can gather information by analyzing the timing differences in a system's behavior.
HMAC (Hash-based Message Authentication Code) is a cryptographic hash function used for message authentication.
An attacker can exploit this vulnerability by sending a large number of requests over a low latency connection and analyzing the timing differences in the HMAC comparison process.
This vulnerability can allow an attacker to forge valid tokens and potentially gain unauthorized access to protected resources.
