CVE-2024-28180

mediumpriority · track · 1EPSS 0.020 · 80 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.96% (80th) EPSS

CVSS 4.3 · medium

Is it mine?

59 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-24

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedcontainerized-data-importer-manifests-0:1.64.0-160000.1.1.x86_64 as component of SUSE Linux Micro 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcontainerized-data-importer-api-0:1.64.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcontainerized-data-importer-cloner-0:1.64.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcontainerized-data-importer-controller-0:1.64.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcontainerized-data-importer-importer-0:1.64.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcontainerized-data-importer-manifests-0:1.64.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcontainerized-data-importer-operator-0:1.64.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcontainerized-data-importer-uploadproxy-0:1.64.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcontainerized-data-importer-uploadserver-0:1.64.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedobs-service-cdi_containers_meta-0:1.64.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · security-advisories@github.comexploitability 2.8 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · OSV

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · SUSE Product Security

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-409USCWE-409USCWE-409US

affected products (59)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Ansible Automation Platformall versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4
Red Hat OpenShift <4.16.24all versionscert_bundDE
Red Hat OpenShift API for Data Protection 1all versionscert_bundDEcpe:/a:redhat:openshift:api_for_data_protection_1
Red Hat OpenShift Container Platform <4.12.63all versionscert_bundDE
Red Hat OpenShift Container Platform <4.14.38all versionscert_bundDE
Red Hat OpenShift Container Platform <4.15.28all versionscert_bundDE
Red Hat OpenShift Container Platform <4.16.0all versionscert_bundDE
Red Hat OpenShift Container Platform <4.16.1all versionscert_bundDE
Red Hat OpenShift Container Platform <4.16.23all versionscert_bundDE
Red Hat OpenShift Container Platform <4.18.10all versionscert_bundDE
Red Hat OpenShift Kube Descheduler Operator 5all versionscert_bundDEcpe:/a:redhat:openshift:kube_descheduler_operator_5
Red Hat OpenShift Run Once Duration Override Operator 1all versionscert_bundDEcpe:/a:redhat:openshift:run_once_duration_override_operator_1
Red Hat OpenShift Secondary Scheduler Operatorall versionscert_bundDEcpe:/a:redhat:openshift:::secondary_scheduler_operator
Red Hat OpenShift Virtualization <4.15.5all versionscert_bundDE

showing 20 of 59

advisories (17)

Vendor and ecosystem advisories describing this.

SUSE-SU-2026:20550-1Security update for containerized-data-importer2026-02-26csaf · suse_csafDE
Security update for containerized-data-importer
WID-SEC-W-2024-0947Red Hat OpenShift: Mehrere SchwachstellenDeutsch2024-04-22csaf · cert_bundDE
Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.
WID-SEC-W-2024-1474Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2024-06-27csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.
WID-SEC-W-2024-2035Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Manipulation von Dateien und Denial of ServiceDeutsch2024-09-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren und um einen Denial of Service zu verursachen.
openSUSE-SU-2026:20279-1Security update for containerized-data-importer2026-02-26csaf · suse_csafDE
Security update for containerized-data-importer
GHSA-c5q2-7r4c-mv6gGo JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)2024-03-07ghsa · osvUS
### Impact An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting. ### Patches The problem is fixed in the following packages and versions: - github.com/go-jose/go-jose/v4 version 4.0.1 - github.com/go-jose/go-jose/v3 version 3.0.3 - gopkg.in/go-jose/go-jose.v2 version 2.6.3 The problem will not be fixed in the following package because the package is archived: - gopkg.in/square/go-jose.v2
CGA-9vg5-h493-cxr72024-06-06vendor · osvUS
CGA-chh8-vhg4-2qj72024-06-06vendor · osvUS
CGA-g5hx-8r47-pf392024-06-06vendor · osvUS
CGA-hmfp-f3v3-528v2024-06-06vendor · osvUS
CGA-hrqx-74pg-5m882024-06-06vendor · osvUS
CGA-m474-c57g-89452024-06-06vendor · osvUS
CGA-r356-23m2-5p372024-06-06vendor · osvUS
CGA-v3wf-pwmr-vcw52024-06-06vendor · osvUS
CGA-w52c-j6q8-cf232024-06-06vendor · osvUS
CGA-w7jq-8v28-882j2024-06-06vendor · osvUS
GO-2024-2631Decompression bomb vulnerability in github.com/go-jose/go-jose2024-03-15vendor · osvUS
An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti.

also known as (16)

Other names and identifiers for this entity.

CNNVD-202403-772 cnnvd
EUVD-2024-0896 enisa_euvd
BDU:2024-01928 fstec_bdu
GHSA-c5q2-7r4c-mv6g enisa_euvd
CGA-9vf9-m4f8-6392osv
CGA-9vg5-h493-cxr7osv
CGA-g5hx-8r47-pf39osv
CGA-hmfp-f3v3-528vosv
CGA-hrqx-74pg-5m88osv
CGA-m474-c57g-8945osv
CGA-r356-23m2-5p37osv
CGA-v3wf-pwmr-vcw5osv
CGA-w52c-j6q8-cf23osv
CGA-w7jq-8v28-882josv
GHSA-c5q2-7r4c-mv6g osv
GO-2024-2631osv

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund suse_csaf NVD CVE.org MITRE

published 2024-03-09modified 2026-06-17

references (42)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan