CVE-2024-28176

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

• CWE-400

• https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314Patch
• https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8bPatch
• https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882qVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/Mailing List, Third Party Advisory
• https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314Patch
• https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8bPatch
• https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882qVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/Mailing List, Third Party Advisory

Published

Mar 9, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28170Improper access control in Intel(R) RAID Web Console all ver…5.5
• CVE-2024-28171 It is possible to perform a path traversal attack and write…8.1
• CVE-2024-28172Uncontrolled search path for some Intel(R) Trace Analyzer an…7.3
• CVE-2024-28173In JetBrains TeamCity between 2023.11 and 2023.11.4 custom b…4.3
• CVE-2024-28174In JetBrains TeamCity before 2023.11.4 presigned URL generat…5.8
• CVE-2024-28175Argo CD is a declarative, GitOps continuous delivery tool fo…5.4
• CVE-2024-28179Jupyter Server Proxy allows users to run arbitrary external …9.8
• CVE-2024-2818An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2024-28180Package jose aims to provide an implementation of the Javasc…4.3
• CVE-2024-28181 turbo_boost-commands is a set of commands to help you build…8.1
• CVE-2024-28182nghttp2 is an implementation of the Hypertext Transfer Proto…5.3
• CVE-2024-28183ESP-IDF is the development framework for Espressif SoCs supp…5.7