-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the HTTP client's cache refresh mechanism in NewStorageFromHTTP. In vulnerable versions (<=0.5.21), the refresh handler processed remote JWK Sets without first clearing existing keys (no KeyDeleteAll call). The commit diff shows the fix added store.KeyDeleteAll() before processing new keys, confirming the previous absence of cache clearance was the root cause. The function manages the auto-caching behavior described in the vulnerability reports, making it the primary point of failure.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/MicahParks/jwkset | go | >= 0.5.0, <= 0.5.21 | 0.6.0 |
Ongoing coverage of React2Shell