AIKIDO-2025-10087

TL;DR

The jwt.Parse function previously used strings.Split to parse its argument, which is untrusted data, by splitting on periods. This allowed a malicious request with an Authorization header containing Bearer followed by numerous period characters to trigger excessive memory allocations—approximately O(n) bytes, where n is the length of the argument, with a constant factor of around 16. This patch optimizes jwt.Parse to allocate O(1) bytes, even when handling such malicious inputs.