CVE-2024-29371

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack	Exploit Issue Tracking Mitigation
https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack	Exploit Issue Tracking Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:jose4j_project:jose4j:*:*:*:*:*:*:*:*

History

27 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) En jose4j anterior a 0.9.6, un atacante puede causar una condición de Denegación de Servicio (DoS) al crear un token malicioso de JSON Web Encryption (JWE) con una relación de compresión excepcionalmente alta. Cuando este token es procesado por el servidor, resulta en una asignación de memoria y un tiempo de procesamiento significativos durante la descompresión.

Information

Published : 2025-12-17 16:16

Updated : 2026-10-27 18:10

NVD link : CVE-2024-29371

Mitre link : CVE-2024-29371

CVE.ORG link : CVE-2024-29371

JSON object : View

Products Affected

jose4j_project

jose4j

CWE

CWE-1259

Improper Restriction of Security Token Assignment

{"id": "CVE-2024-29371", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-29371", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T18:38:20.096134Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-17T16:16:04.567", "references": [{"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack", "tags": ["Exploit", "Issue Tracking", "Mitigation"], "source": "cve@mitre.org"}, {"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack", "tags": ["Exploit", "Issue Tracking", "Mitigation"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1259"}]}], "descriptions": [{"lang": "en", "value": "In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression."}, {"lang": "es", "value": "En jose4j anterior a 0.9.6, un atacante puede causar una condici\u00f3n de Denegaci\u00f3n de Servicio (DoS) al crear un token malicioso de JSON Web Encryption (JWE) con una relaci\u00f3n de compresi\u00f3n excepcionalmente alta. Cuando este token es procesado por el servidor, resulta en una asignaci\u00f3n de memoria y un tiempo de procesamiento significativos durante la descompresi\u00f3n."}], "lastModified": "2026-10-27T18:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jose4j_project:jose4j:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE62FF6D-FC62-42B0-9ED4-76A0C4419975", "versionEndExcluding": "0.9.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}