Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade container-selinuxUpgrade skopeo-testsUpgrade podman-dockerUpgrade buildah-testsUpgrade python3-criuUpgrade slirp4netnsUpgrade buildahUpgrade criu-libsUpgrade podman-testsUpgrade libslirpUpgrade aardvark-dnsUpgrade libslirp-develUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade python3-podmanUpgrade podman-catatonitUpgrade toolbox-testsUpgrade crunUpgrade criuUpgrade critUpgrade oci-seccomp-bpf-hookUpgrade udicaUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade netavarkUpgrade fuse-overlayfsUpgrade podmanUpgrade runcUpgrade criu-develUpgrade podman-pluginsUpgrade toolboxUpgrade conmonUpgrade containers-commonUpgrade skopeo | May 8, 2024 | Mar 9, 2024 |
| Alpine Linux | — | Upgrade buildah | Aug 22, 2024 | Mar 9, 2024 |
| Amazon Linux Ami 2 | — | Upgrade nerdctl-debuginfoUpgrade containerd-stressUpgrade containerdUpgrade nerdctlUpgrade containerd-debuginfo | Aug 14, 2024 | Mar 9, 2024 |
| Amazon_linux_2023 | — | Upgrade nerdctl | Feb 17, 2025 | Mar 9, 2024 |
| Debian | — | No solution existsUpgrade golang-gopkg-square-go-jose.v2Upgrade golang-github-go-jose-go-jose | May 15, 2025 | Mar 9, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Dell Powerstore Dsa2025050 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jan 28, 2025 |
| Freebsd | — | Upgrade oauth2-proxy | Oct 22, 2024 | Oct 18, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade critUpgrade podman-remoteUpgrade netavarkUpgrade podman-gvproxyUpgrade buildah-testsUpgrade criuUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade udicaUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade podmanUpgrade libslirpUpgrade buildahUpgrade conmonUpgrade runcUpgrade podman-catatonitUpgrade podman-testsUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade crunUpgrade podman-pluginsUpgrade criu-develUpgrade skopeo-testsUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade container-selinuxUpgrade python3-criu | May 7, 2024 | Mar 9, 2024 |
| Redhat Openshift | — | Upgrade skopeoUpgrade podmanUpgrade cri-oUpgrade openshift-clients | Mar 28, 2024 | Mar 9, 2024 |
| Redhat_linux | — | Upgrade containernetworking-plugins-debugsourceUpgrade podmanUpgrade podman-pluginsUpgrade podman-catatonitUpgrade udicaUpgrade toolbox-testsUpgrade buildah-debugsourceUpgrade netavarkUpgrade criuUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade conmonUpgrade podman-remote-debuginfoUpgrade python3-podmanUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade containernetworking-pluginsUpgrade crunUpgrade conmon-debugsourceUpgrade podman-catatonit-debuginfoUpgrade skopeoUpgrade fuse-overlayfs-debuginfoNo solution existsUpgrade toolboxUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfsUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildahUpgrade skopeo-debugsourceUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade podman-gvproxyUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade crun-debuginfoUpgrade criu-debugsourceUpgrade criu-develUpgrade toolbox-debuginfoUpgrade podman-testsUpgrade podman-debugsourceUpgrade criu-libsUpgrade critUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade container-selinuxUpgrade slirp4netns-debugsourceUpgrade conmon-debuginfoUpgrade cockpit-podmanUpgrade libslirp-develUpgrade podman-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netnsUpgrade runcUpgrade libslirp-debugsourceUpgrade libslirpUpgrade skopeo-debuginfoUpgrade runc-debuginfoUpgrade podman-remoteUpgrade podman-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debuginfoUpgrade buildah-tests | May 1, 2024 | Mar 9, 2024 |
| Rocky_linux | — | Upgrade runc-debugsourceUpgrade buildah-debugsourceUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade buildahUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade netavarkUpgrade fuse-overlayfs-debuginfoUpgrade conmonUpgrade conmon-debugsourceUpgrade crun-debuginfoUpgrade criu-libsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-tests-debuginfoUpgrade containers-commonUpgrade libslirpUpgrade conmon-debuginfoUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade toolboxUpgrade criu-debugsourceUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-debugsourceUpgrade critUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debuginfoUpgrade skopeo-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-catatonitUpgrade containernetworking-plugins-debuginfoUpgrade skopeoUpgrade slirp4netns-debuginfoUpgrade podmanUpgrade criu-libs-debuginfoUpgrade runcUpgrade podman-remoteUpgrade skopeo-debuginfoUpgrade podman-debugsourceUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade python3-criuUpgrade podman-testsUpgrade podman-debuginfoUpgrade crunUpgrade criuUpgrade buildah-testsUpgrade criu-develUpgrade toolbox-testsUpgrade toolbox-debugsource | May 13, 2024 | Mar 9, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.3Upgrade Splunk Enterprise to version 9.3.1Upgrade Splunk Enterprise to version 9.1.6 | Sep 30, 2025 | Mar 9, 2024 |
| Suse | — | Upgrade apptainer-leapUpgrade skopeoUpgrade libgpg-error-develUpgrade skopeo-bash-completionUpgrade docker-fish-completionUpgrade skopeo-zsh-completionUpgrade apptainer-sle15_6Upgrade libgpg-error0Upgrade docker-bash-completionUpgrade dockerUpgrade velociraptor-clientUpgrade system-user-velociraptorUpgrade apptainerUpgrade docker-zsh-completionUpgrade grafanaUpgrade docker-rootless-extrasUpgrade buildahUpgrade libgpg-error0-32bitUpgrade skopeo-fish-completionUpgrade velociraptorUpgrade apptainer-sle15_5 | Jun 12, 2024 | Mar 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub