GitHub Advisoryadvisory · Maven

GHSA-6qvw-249j-h44c jose4j denial of service via specifically crafted JWE

MEDIUM Published 2024-02-29 Modified 2025-11-04 Official page ↗

Aliases: CVE-2023-51775
Ecosystem: Maven
Packages: org.bitbucket.b_c:jose4j
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-400
Reviewed: 2024-02-29

Affected packages

• Maven org.bitbucket.b_c:jose4j: < 0.9.4 → fixed in 0.9.4

Description

The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Related

Alias · CVE (1)

CVE-2023-51775 The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2… vulnerability

Weakness · CWE (1)

CWE-400 Uncontrolled Resource Consumption weakness

References