GHSA-3677-xxcr-wjqv

ghsaUSosv

jose4j is vulnerable to DoS via compressed JWE content

view advisory published 2025-12-17Licence: CC-BY-4.0

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-29371US	—	0.26% (16th)	—	2025-12-17
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression rat…

references

External citations — patches, advisories, analysis.

https://bitbucket.org/b_c/jose4j/commits/19a90a64c47bb07c4aa5462f1316d5c293d81fcfWEB
https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attackWEB
https://bitbucket.org/b_c/jose4j/wiki/HomePACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2024-29371ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan