id: GO-2025-3376
modules:
    - module: github.com/MicahParks/jwkset
      versions:
        - introduced: 0.5.0
        - fixed: 0.6.0
      vulnerable_at: 0.5.21
summary: |-
    JWK Set's HTTP client only overwrites and appends JWK to local cache during
    refresh in github.com/MicahParks/jwkset
cves:
    - CVE-2025-22149
ghsas:
    - GHSA-675f-rq2r-jw82
references:
    - advisory: https://github.com/MicahParks/jwkset/security/advisories/GHSA-675f-rq2r-jw82
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-22149
    - fix: https://github.com/MicahParks/jwkset/commit/01db49a90f7f20c7fb39a699a2f19a7a5f379ed3
    - fix: https://github.com/MicahParks/jwkset/pull/41
    - report: https://github.com/MicahParks/jwkset/issues/40
source:
    id: GHSA-675f-rq2r-jw82
    created: 2025-01-09T14:17:18.394896-05:00
review_status: UNREVIEWED