Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade criu-libsUpgrade aardvark-dnsUpgrade podman-dockerUpgrade skopeo-testsUpgrade container-selinuxUpgrade podman-testsUpgrade libslirp-develUpgrade libslirpUpgrade podman-gvproxyUpgrade buildah-testsUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade buildahUpgrade containernetworking-pluginsUpgrade toolbox-testsUpgrade containers-commonUpgrade netavarkUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade conmonUpgrade criuUpgrade podman-catatonitUpgrade python3-podmanUpgrade crunUpgrade criu-develUpgrade runcUpgrade podmanUpgrade skopeoUpgrade udicaUpgrade toolboxUpgrade podman-remoteUpgrade podman-plugins | May 8, 2024 | Mar 9, 2024 |
| Alpine Linux | — | Upgrade buildah | Aug 22, 2024 | Mar 9, 2024 |
| Amazon Linux Ami 2 | — | Upgrade nerdctl-debuginfoUpgrade containerd-stressUpgrade nerdctlUpgrade containerdUpgrade containerd-debuginfo | Aug 14, 2024 | Mar 9, 2024 |
| Amazon_linux_2023 | — | Upgrade nerdctl | Feb 17, 2025 | Mar 9, 2024 |
| Debian | — | Upgrade golang-github-go-jose-go-joseUpgrade golang-gopkg-square-go-jose.v2 | May 15, 2025 | Mar 9, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Dell Powerstore Dsa2025050 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jan 28, 2025 |
| Freebsd | — | Upgrade oauth2-proxy | Oct 22, 2024 | Oct 18, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade podman-gvproxyUpgrade critUpgrade podmanUpgrade buildahUpgrade cockpit-podmanUpgrade podman-testsUpgrade runcUpgrade podman-remoteUpgrade udicaUpgrade buildah-testsUpgrade podman-dockerUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade criuUpgrade podman-catatonitUpgrade netavarkUpgrade conmonUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade libslirpUpgrade podman-pluginsUpgrade criu-develUpgrade container-selinuxUpgrade skopeo-testsUpgrade libslirp-develUpgrade crunUpgrade criu-libsUpgrade python3-criuUpgrade skopeoUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade containers-common | May 7, 2024 | Mar 9, 2024 |
| Redhat Openshift | — | Upgrade podmanUpgrade openshift-clientsUpgrade skopeoUpgrade cri-o | Mar 28, 2024 | Mar 9, 2024 |
| Redhat_linux | — | Upgrade podman-pluginsUpgrade netavarkUpgrade buildah-debuginfoUpgrade containers-commonUpgrade podman-catatonitUpgrade criuUpgrade conmonUpgrade udicaUpgrade podmanNo solution existsUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade toolbox-testsUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade buildah-tests-debuginfoUpgrade crun-debugsourceUpgrade podman-remote-debuginfoUpgrade crunUpgrade criu-debuginfoUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade toolboxUpgrade python3-podmanUpgrade fuse-overlayfs-debugsourceUpgrade skopeoUpgrade toolbox-debugsourceUpgrade podman-catatonit-debuginfoUpgrade conmon-debugsourceUpgrade skopeo-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade skopeo-testsUpgrade libslirp-debuginfoUpgrade python3-criuUpgrade podman-debuginfoUpgrade libslirp-develUpgrade runc-debugsourceUpgrade podman-dockerUpgrade crun-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade criu-debugsourceUpgrade libslirpUpgrade containernetworking-plugins-debuginfoUpgrade podman-remoteUpgrade runc-debuginfoUpgrade podman-gvproxyUpgrade toolbox-debuginfoUpgrade critUpgrade aardvark-dnsUpgrade podman-debugsourceUpgrade podman-testsUpgrade skopeo-debuginfoUpgrade slirp4netns-debugsourceUpgrade conmon-debuginfoUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade runcUpgrade buildah-testsUpgrade criu-libsUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-debugsource | May 1, 2024 | Mar 9, 2024 |
| Rocky_linux | — | Upgrade podman-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade toolbox-debuginfoUpgrade criu-develUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debugsourceUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podmanUpgrade podman-catatonitUpgrade runcUpgrade skopeoUpgrade criu-libs-debuginfoUpgrade podman-pluginsUpgrade toolbox-testsUpgrade podman-gvproxyUpgrade libslirp-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade skopeo-debugsourceUpgrade containernetworking-pluginsUpgrade slirp4netnsUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade podman-debugsourceUpgrade skopeo-debuginfoUpgrade podman-testsUpgrade critUpgrade podman-debuginfoUpgrade criuUpgrade crunUpgrade python3-criuUpgrade slirp4netns-debugsourceUpgrade buildah-testsUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade skopeo-testsUpgrade criu-libsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade aardvark-dnsUpgrade runc-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debuginfoUpgrade podman-catatonit-debuginfoUpgrade netavarkUpgrade crun-debugsourceUpgrade buildahUpgrade libslirp-develUpgrade crun-debuginfoUpgrade conmon-debugsourceUpgrade conmonUpgrade runc-debugsourceUpgrade criu-debuginfoUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade toolbox | May 13, 2024 | Mar 9, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.6Upgrade Splunk Enterprise to version 9.3.1Upgrade Splunk Enterprise to version 9.2.3 | Sep 30, 2025 | Mar 9, 2024 |
| Suse | — | Upgrade apptainer-sle15_6Upgrade dockerUpgrade skopeo-zsh-completionUpgrade apptainer-leapUpgrade libgpg-error-develUpgrade docker-fish-completionUpgrade docker-bash-completionUpgrade skopeo-bash-completionUpgrade velociraptor-clientUpgrade system-user-velociraptorUpgrade skopeoUpgrade libgpg-error0Upgrade apptainerUpgrade velociraptorUpgrade skopeo-fish-completionUpgrade grafanaUpgrade buildahUpgrade apptainer-sle15_5Upgrade docker-rootless-extrasUpgrade libgpg-error0-32bitUpgrade docker-zsh-completion | Jun 12, 2024 | Mar 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub