CVE-2024-29371
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-29371
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29371.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-29371
- Aliases
- Downstream
- Related
- Published
- 2025-12-17T16:16:04.567Z
- Modified
- 2026-01-07T14:47:27.931573Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In jose4j before 0.9.5, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
- References
Affected packages
Git / bitbucket.org/b_c/jose4j
Affected ranges
- Type
- GIT
- Repo
- https://bitbucket.org/b_c/jose4j
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed93247d89ecc5a6d89acfb4b251270b8b6b769992
Affected versions
jose4j-0.*
jose4j-0.1.0
jose4j-0.1.1
jose4j-0.2.0
jose4j-0.2.1
jose4j-0.2.2
jose4j-0.2.3
jose4j-0.2.4
jose4j-0.2.5
jose4j-0.2.6
jose4j-0.2.7
jose4j-0.3.0
jose4j-0.3.1
jose4j-0.3.2
jose4j-0.3.3
jose4j-0.3.4
jose4j-0.3.5
jose4j-0.3.6
jose4j-0.3.7
jose4j-0.3.8
jose4j-0.3.9
jose4j-0.4.0
jose4j-0.4.1
jose4j-0.4.2
jose4j-0.4.3
jose4j-0.4.4
jose4j-0.5.0
jose4j-0.5.1
jose4j-0.5.2
jose4j-0.5.3
jose4j-0.5.4
jose4j-0.5.5
jose4j-0.5.6
jose4j-0.5.7
jose4j-0.5.8
jose4j-0.6.0
jose4j-0.6.1
jose4j-0.6.2
jose4j-0.6.3
jose4j-0.6.4
jose4j-0.6.5
jose4j-0.7.0
jose4j-0.7.1
jose4j-0.7.10
jose4j-0.7.11
jose4j-0.7.12
jose4j-0.7.2
jose4j-0.7.3
jose4j-0.7.4
jose4j-0.7.5
jose4j-0.7.6
jose4j-0.7.7
jose4j-0.7.8
jose4j-0.7.9
jose4j-0.8.0
jose4j-0.9.0
jose4j-0.9.1
jose4j-0.9.2
jose4j-0.9.3
jose4j-0.9.4