Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade python3-criuUpgrade cockpit-podmanUpgrade buildah-testsUpgrade criu-libsUpgrade podman-dockerUpgrade podman-testsUpgrade libslirp-develUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade buildahUpgrade podman-gvproxyUpgrade container-selinuxUpgrade skopeo-testsUpgrade conmonUpgrade skopeoUpgrade crunUpgrade toolboxUpgrade python3-podmanUpgrade criuUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade critUpgrade podman-pluginsUpgrade runcUpgrade udicaUpgrade containers-commonUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade netavarkUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade podman | May 8, 2024 | Mar 9, 2024 |
| Alpine Linux | — | Upgrade buildah | Aug 22, 2024 | Mar 9, 2024 |
| Amazon Linux Ami 2 | — | Upgrade nerdctl-debuginfoUpgrade containerdUpgrade nerdctlUpgrade containerd-debuginfoUpgrade containerd-stress | Aug 14, 2024 | Mar 9, 2024 |
| Amazon_linux_2023 | — | Upgrade nerdctl | Feb 17, 2025 | Mar 9, 2024 |
| Debian | — | Upgrade golang-github-go-jose-go-joseNo solution existsUpgrade golang-gopkg-square-go-jose.v2 | May 15, 2025 | Mar 9, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Dell Powerstore Dsa2025050 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jan 28, 2025 |
| Freebsd | — | Upgrade oauth2-proxy | Oct 22, 2024 | Oct 18, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade skopeoUpgrade container-selinuxUpgrade skopeo-testsUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade criu-develUpgrade crunUpgrade python3-criuUpgrade podman-dockerUpgrade runcUpgrade fuse-overlayfsUpgrade podman-testsUpgrade podman-remoteUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade udicaUpgrade libslirpUpgrade slirp4netnsUpgrade critUpgrade podmanUpgrade cockpit-podmanUpgrade buildahUpgrade criuUpgrade buildah-testsUpgrade netavarkUpgrade conmonUpgrade python3-podman | May 7, 2024 | Mar 9, 2024 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade skopeoUpgrade cri-oUpgrade podman | Mar 28, 2024 | Mar 9, 2024 |
| Redhat_linux | — | Upgrade containernetworking-pluginsNo solution existsUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade criuUpgrade conmon-debugsourceUpgrade buildah-tests-debuginfoUpgrade conmonUpgrade containers-commonUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade toolbox-testsUpgrade podman-catatonitUpgrade udicaUpgrade podman-pluginsUpgrade netavarkUpgrade criu-debuginfoUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade crunUpgrade toolboxUpgrade buildahUpgrade python3-podmanUpgrade podman-catatonit-debuginfoUpgrade podmanUpgrade criu-libs-debuginfoUpgrade skopeo-debugsourceUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netnsUpgrade python3-criuUpgrade podman-gvproxyUpgrade criu-libsUpgrade aardvark-dnsUpgrade critUpgrade podman-remoteUpgrade podman-debuginfoUpgrade libslirpUpgrade skopeo-debuginfoUpgrade toolbox-debuginfoUpgrade conmon-debuginfoUpgrade runcUpgrade podman-plugins-debuginfoUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade crun-debuginfoUpgrade runc-debugsourceUpgrade criu-debugsourceUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade criu-develUpgrade podman-dockerUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-testsUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade libslirp-develUpgrade runc-debuginfoUpgrade cockpit-podmanUpgrade podman-testsUpgrade podman-debugsource | May 1, 2024 | Mar 9, 2024 |
| Rocky_linux | — | Upgrade fuse-overlayfsUpgrade podman-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade podman-gvproxy-debuginfoUpgrade criu-develUpgrade libslirp-debuginfoUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade crunUpgrade criuUpgrade podman-debuginfoUpgrade podman-testsUpgrade buildah-testsUpgrade critUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade skopeoUpgrade skopeo-debuginfoUpgrade podman-remoteUpgrade criu-libs-debuginfoUpgrade podmanUpgrade skopeo-debugsourceUpgrade podman-pluginsUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-testsUpgrade containernetworking-pluginsUpgrade runcUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade buildahUpgrade crun-debugsourceUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade netavarkUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade criu-libsUpgrade conmon-debugsourceUpgrade conmonUpgrade libslirpUpgrade buildah-tests-debuginfoUpgrade toolboxUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade containers-commonUpgrade runc-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsource | May 13, 2024 | Mar 9, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.3Upgrade Splunk Enterprise to version 9.3.1Upgrade Splunk Enterprise to version 9.1.6 | Sep 30, 2025 | Mar 9, 2024 |
| Suse | — | Upgrade system-user-velociraptorUpgrade libgpg-error0Upgrade libgpg-error-develUpgrade skopeo-zsh-completionUpgrade skopeo-bash-completionUpgrade apptainer-leapUpgrade docker-fish-completionUpgrade docker-bash-completionUpgrade dockerUpgrade skopeoUpgrade velociraptor-clientUpgrade apptainer-sle15_6Upgrade docker-rootless-extrasUpgrade grafanaUpgrade skopeo-fish-completionUpgrade buildahUpgrade libgpg-error0-32bitUpgrade velociraptorUpgrade docker-zsh-completionUpgrade apptainerUpgrade apptainer-sle15_5 | Jun 12, 2024 | Mar 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub