GitHub Advisoryadvisory · Maven

GHSA-3677-xxcr-wjqv jose4j is vulnerable to DoS via compressed JWE content

HIGH Published 2025-12-17 Modified 2026-01-06 Official page ↗
Aliases
CVE-2024-29371
Ecosystem
Maven
Packages
org.bitbucket.b_c:jose4j
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1259
Reviewed
2025-12-18

Affected packages

• Maven org.bitbucket.b_c:jose4j: < 0.9.6 → fixed in 0.9.6

Description

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Related

Alias · CVE (1)

  • CVE-2024-29371 In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token… vulnerability

Weakness · CWE (1)

  • CWE-1259 Improper Restriction of Security Token Assignment weakness

References