High severityNVD Advisory· Published Nov 12, 2025· Updated Nov 13, 2025

CVE-2025-63811

Description

An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high compression ratio.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/dvsekhvalnov/jose2goGo	< 1.7.0	1.7.0

Affected products

120

dvsekhvalnov/jose2godescription
osv-coords119 versions
pkg:apk/chainguard/amazon-cloudwatch-agent pkg:apk/chainguard/amazon-cloudwatch-agent-fips pkg:apk/chainguard/argo-events pkg:apk/chainguard/argo-events-compat pkg:apk/chainguard/argo-events-fips pkg:apk/chainguard/argo-events-fips-compat pkg:apk/chainguard/bento pkg:apk/chainguard/bento-compat pkg:apk/chainguard/cluster-api-aws-controller pkg:apk/chainguard/cluster-api-aws-controller-compat pkg:apk/chainguard/cluster-api-aws-controller-fips pkg:apk/chainguard/dapr-1.15 pkg:apk/chainguard/dapr-daprd-1.15 pkg:apk/chainguard/dapr-daprd-1.15-oci-compat pkg:apk/chainguard/dapr-daprd-fips-1.14 pkg:apk/chainguard/dapr-daprd-fips-1.15 pkg:apk/chainguard/dapr-daprd-fips-1.15-oci-compat pkg:apk/chainguard/dapr-fips-1.15 pkg:apk/chainguard/dapr-injector-1.15 pkg:apk/chainguard/dapr-injector-1.15-oci-compat pkg:apk/chainguard/dapr-injector-fips-1.15 pkg:apk/chainguard/dapr-injector-fips-1.15-oci-compat pkg:apk/chainguard/dapr-operator-1.15 pkg:apk/chainguard/dapr-operator-1.15-oci-compat pkg:apk/chainguard/dapr-operator-fips-1.15 pkg:apk/chainguard/dapr-operator-fips-1.15-oci-compat pkg:apk/chainguard/dapr-placement-1.15 pkg:apk/chainguard/dapr-placement-1.15-oci-compat pkg:apk/chainguard/dapr-placement-fips-1.15 pkg:apk/chainguard/dapr-placement-fips-1.15-oci-compat pkg:apk/chainguard/dapr-scheduler-1.15 pkg:apk/chainguard/dapr-scheduler-1.15-oci-compat pkg:apk/chainguard/dapr-scheduler-fips-1.15 pkg:apk/chainguard/dapr-scheduler-fips-1.15-oci-compat pkg:apk/chainguard/dapr-sentry-1.15 pkg:apk/chainguard/dapr-sentry-1.15-oci-compat pkg:apk/chainguard/dapr-sentry-fips-1.15 pkg:apk/chainguard/dapr-sentry-fips-1.15-oci-compat pkg:apk/chainguard/grafana-alloy pkg:apk/chainguard/grafana-alloy-compat pkg:apk/chainguard/jitsucom-bulker pkg:apk/chainguard/jitsucom-bulker-bulker pkg:apk/chainguard/jitsucom-bulker-bulker-compat pkg:apk/chainguard/jitsucom-bulker-ingest pkg:apk/chainguard/jitsucom-bulker-ingest-compat pkg:apk/chainguard/jitsucom-bulker-ingmgr pkg:apk/chainguard/jitsucom-bulker-ingmgr-compat pkg:apk/chainguard/jitsucom-bulker-sidecar pkg:apk/chainguard/jitsucom-bulker-sidecar-compat pkg:apk/chainguard/jitsucom-bulker-syncctl pkg:apk/chainguard/jitsucom-bulker-syncctl-compat pkg:apk/chainguard/opentelemetry-collector-contrib pkg:apk/chainguard/opentelemetry-collector-contrib-compat pkg:apk/chainguard/splunk-otel-collector pkg:apk/chainguard/splunk-otel-collector-compat pkg:apk/chainguard/splunk-otel-collector-doc pkg:apk/chainguard/splunk-otel-collector-fips pkg:apk/chainguard/splunk-otel-collector-migratecheckpoint pkg:apk/chainguard/splunk-otel-collector-migratecheckpoint-compat pkg:apk/chainguard/sql_exporter pkg:apk/chainguard/sql_exporter-compat pkg:apk/chainguard/sql_exporter-fips pkg:apk/chainguard/telegraf-1.34 pkg:apk/chainguard/telegraf-1.35 pkg:apk/chainguard/vault-1.16 pkg:apk/chainguard/vault-1.16-compat pkg:apk/chainguard/vault-1.17 pkg:apk/chainguard/vault-1.17-compat pkg:apk/chainguard/vault-1.21 pkg:apk/chainguard/vault-1.21-compat pkg:apk/chainguard/vault-fips-1.19 pkg:apk/chainguard/vault-fips-1.19-compat pkg:apk/chainguard/vault-fips-1.21 pkg:apk/chainguard/vault-fips-1.21-compat pkg:apk/wolfi/amazon-cloudwatch-agent pkg:apk/wolfi/argo-events pkg:apk/wolfi/argo-events-compat pkg:apk/wolfi/bento pkg:apk/wolfi/bento-compat pkg:apk/wolfi/cluster-api-aws-controller pkg:apk/wolfi/cluster-api-aws-controller-compat pkg:apk/wolfi/dapr-1.15 pkg:apk/wolfi/dapr-daprd-1.15 pkg:apk/wolfi/dapr-daprd-1.15-oci-compat pkg:apk/wolfi/dapr-injector-1.15 pkg:apk/wolfi/dapr-injector-1.15-oci-compat pkg:apk/wolfi/dapr-operator-1.15 pkg:apk/wolfi/dapr-operator-1.15-oci-compat pkg:apk/wolfi/dapr-placement-1.15 pkg:apk/wolfi/dapr-placement-1.15-oci-compat pkg:apk/wolfi/dapr-scheduler-1.15 pkg:apk/wolfi/dapr-scheduler-1.15-oci-compat pkg:apk/wolfi/dapr-sentry-1.15 pkg:apk/wolfi/dapr-sentry-1.15-oci-compat pkg:apk/wolfi/grafana-alloy pkg:apk/wolfi/grafana-alloy-compat pkg:apk/wolfi/jitsucom-bulker pkg:apk/wolfi/jitsucom-bulker-bulker pkg:apk/wolfi/jitsucom-bulker-bulker-compat pkg:apk/wolfi/jitsucom-bulker-ingest pkg:apk/wolfi/jitsucom-bulker-ingest-compat pkg:apk/wolfi/jitsucom-bulker-ingmgr pkg:apk/wolfi/jitsucom-bulker-ingmgr-compat pkg:apk/wolfi/jitsucom-bulker-sidecar pkg:apk/wolfi/jitsucom-bulker-sidecar-compat pkg:apk/wolfi/jitsucom-bulker-syncctl pkg:apk/wolfi/jitsucom-bulker-syncctl-compat pkg:apk/wolfi/opentelemetry-collector-contrib pkg:apk/wolfi/opentelemetry-collector-contrib-compat pkg:apk/wolfi/splunk-otel-collector pkg:apk/wolfi/splunk-otel-collector-compat pkg:apk/wolfi/splunk-otel-collector-doc pkg:apk/wolfi/splunk-otel-collector-migratecheckpoint pkg:apk/wolfi/splunk-otel-collector-migratecheckpoint-compat pkg:apk/wolfi/sql_exporter pkg:apk/wolfi/sql_exporter-compat pkg:apk/wolfi/telegraf-1.34 pkg:apk/wolfi/telegraf-1.35 pkg:golang/github.com/dvsekhvalnov/jose2go
< 1.300070.0-r1+ 118 more
- (no CPE)range: < 1.300070.0-r1
- (no CPE)range: < 1.300070.0-r2
- (no CPE)range: < 1.9.8-r1
- (no CPE)range: < 1.9.8-r1
- (no CPE)range: < 1.9.8-r1
- (no CPE)range: < 1.9.8-r1
- (no CPE)range: < 1.12.1-r2
- (no CPE)range: < 1.12.1-r2
- (no CPE)range: < 2.9.2-r1
- (no CPE)range: < 2.9.2-r1
- (no CPE)range: < 2.9.2-r2
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.14.5-r10
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.11.3-r2
- (no CPE)range: < 1.11.3-r2
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 0.139.0-r1
- (no CPE)range: < 0.139.0-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.18.4-r1
- (no CPE)range: < 0.18.4-r1
- (no CPE)range: < 0.18.4-r2
- (no CPE)range: < 1.34.4-r7
- (no CPE)range: < 1.35.4-r3
- (no CPE)range: < 1.16.3-r27
- (no CPE)range: < 1.16.3-r27
- (no CPE)range: < 1.17.6-r19
- (no CPE)range: < 1.17.6-r19
- (no CPE)range: < 1.21.1-r0
- (no CPE)range: < 1.21.1-r0
- (no CPE)range: < 1.19.5-r9
- (no CPE)range: < 1.19.5-r9
- (no CPE)range: < 1.21.1-r0
- (no CPE)range: < 1.21.1-r0
- (no CPE)range: < 1.300070.0-r1
- (no CPE)range: < 1.9.8-r1
- (no CPE)range: < 1.9.8-r1
- (no CPE)range: < 1.12.1-r2
- (no CPE)range: < 1.12.1-r2
- (no CPE)range: < 2.9.2-r1
- (no CPE)range: < 2.9.2-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.15.13-r1
- (no CPE)range: < 1.11.3-r2
- (no CPE)range: < 1.11.3-r2
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 2.11.913-r1
- (no CPE)range: < 0.139.0-r1
- (no CPE)range: < 0.139.0-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.139.2-r1
- (no CPE)range: < 0.18.4-r1
- (no CPE)range: < 0.18.4-r1
- (no CPE)range: < 1.34.4-r7
- (no CPE)range: < 1.35.4-r3
- (no CPE)range: < 1.7.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-9mj6-hxhv-w67jghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-63811ghsaADVISORY
github.com/dvsekhvalnov/jose2go/commit/0a0673dd7f2820a446de5b04b9094b2291d77d5dghsaWEB
github.com/dvsekhvalnov/jose2go/issues/33ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000