Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-pluginsUpgrade containers-commonUpgrade toolbox-testsUpgrade crunUpgrade conmonUpgrade python3-podmanUpgrade criu-develUpgrade critUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade podmanUpgrade fuse-overlayfsUpgrade toolboxUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade udicaUpgrade criuUpgrade podman-catatonitUpgrade netavarkUpgrade runcUpgrade podman-gvproxyUpgrade podman-testsUpgrade libslirpUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade criu-libsUpgrade skopeo-testsUpgrade libslirp-develUpgrade buildah-testsUpgrade podman-dockerUpgrade python3-criuUpgrade buildahUpgrade container-selinuxUpgrade cockpit-podman | May 8, 2024 | Mar 9, 2024 |
| Alpine Linux | — | Upgrade buildah | Aug 22, 2024 | Mar 9, 2024 |
| Amazon Linux Ami 2 | — | Upgrade nerdctl-debuginfoUpgrade containerd-stressUpgrade nerdctlUpgrade containerd-debuginfoUpgrade containerd | Aug 14, 2024 | Mar 9, 2024 |
| Amazon_linux_2023 | — | Upgrade nerdctl | Feb 17, 2025 | Mar 9, 2024 |
| Debian | — | Upgrade golang-github-go-jose-go-joseUpgrade golang-gopkg-square-go-jose.v2 | May 15, 2025 | Mar 9, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Dell Powerstore Dsa2025050 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jan 28, 2025 |
| Freebsd | — | Upgrade oauth2-proxy | Oct 22, 2024 | Oct 18, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade container-selinuxUpgrade containers-commonUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade criu-libsUpgrade skopeoUpgrade containernetworking-pluginsUpgrade criu-develUpgrade crunUpgrade python3-criuUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade podman-testsUpgrade runcUpgrade udicaUpgrade aardvark-dnsUpgrade buildah-testsUpgrade netavarkUpgrade criuUpgrade libslirpUpgrade podman-dockerUpgrade critUpgrade slirp4netnsUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade conmonUpgrade podmanUpgrade cockpit-podmanUpgrade buildahUpgrade podman-remote | May 7, 2024 | Mar 9, 2024 |
| Redhat Openshift | — | Upgrade skopeoUpgrade openshift-clientsUpgrade podmanUpgrade cri-o | Mar 28, 2024 | Mar 9, 2024 |
| Redhat_linux | — | Upgrade container-selinuxUpgrade criu-libsUpgrade runcUpgrade slirp4netnsUpgrade slirp4netns-debuginfoUpgrade crun-debuginfoUpgrade podman-dockerUpgrade runc-debugsourceUpgrade toolbox-debuginfoUpgrade skopeo-testsUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-debugsourceUpgrade podman-plugins-debuginfoUpgrade conmon-debuginfoUpgrade buildah-testsUpgrade podman-gvproxy-debuginfoUpgrade aardvark-dnsUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade libslirp-debuginfoUpgrade python3-criuUpgrade podman-testsUpgrade critUpgrade libslirp-develUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade libslirpUpgrade podman-debuginfoUpgrade skopeo-debuginfoUpgrade podman-gvproxyUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolbox-debugsourceUpgrade fuse-overlayfsNo solution existsUpgrade conmon-debugsourceUpgrade podman-catatonit-debuginfoUpgrade toolbox-testsUpgrade buildah-tests-debuginfoUpgrade containers-commonUpgrade toolboxUpgrade buildahUpgrade conmonUpgrade udicaUpgrade criuUpgrade fuse-overlayfs-debugsourceUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debugsourceUpgrade podmanUpgrade containernetworking-pluginsUpgrade netavarkUpgrade podman-pluginsUpgrade podman-catatonitUpgrade python3-podmanUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade crun-debugsourceUpgrade buildah-debuginfoUpgrade criu-debuginfo | May 1, 2024 | Mar 9, 2024 |
| Rocky_linux | — | Upgrade skopeoUpgrade toolbox-debuginfoUpgrade podman-catatonitUpgrade runcUpgrade criu-develUpgrade podman-plugins-debuginfoUpgrade skopeo-debuginfoUpgrade podman-pluginsUpgrade toolbox-debugsourceUpgrade toolbox-testsUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade containernetworking-pluginsUpgrade podmanUpgrade containernetworking-plugins-debuginfoUpgrade podman-remoteUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade buildah-testsUpgrade podman-debuginfoUpgrade skopeo-debugsourceUpgrade slirp4netnsUpgrade crunUpgrade podman-gvproxyUpgrade criuUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfsUpgrade critUpgrade python3-criuUpgrade podman-debugsourceUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debuginfoUpgrade libslirpUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade conmon-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade skopeo-testsUpgrade buildahUpgrade podman-catatonit-debuginfoUpgrade netavarkUpgrade libslirp-develUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade aardvark-dnsUpgrade buildah-debugsourceUpgrade runc-debugsourceUpgrade conmon-debugsourceUpgrade conmonUpgrade crun-debuginfoUpgrade runc-debuginfoUpgrade criu-debugsource | May 13, 2024 | Mar 9, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.6Upgrade Splunk Enterprise to version 9.2.3Upgrade Splunk Enterprise to version 9.3.1 | Sep 30, 2025 | Mar 9, 2024 |
| Suse | — | Upgrade skopeo-zsh-completionUpgrade libgpg-error-develUpgrade docker-bash-completionUpgrade apptainer-sle15_6Upgrade velociraptor-clientUpgrade libgpg-error0Upgrade apptainer-leapUpgrade docker-fish-completionUpgrade skopeoUpgrade system-user-velociraptorUpgrade dockerUpgrade skopeo-bash-completionUpgrade apptainer-sle15_5Upgrade apptainerUpgrade skopeo-fish-completionUpgrade docker-rootless-extrasUpgrade libgpg-error0-32bitUpgrade velociraptorUpgrade docker-zsh-completionUpgrade grafanaUpgrade buildah | Jun 12, 2024 | Mar 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub