Jose4j
CVEs (3)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-29371 | Hig | 0.49 | 7.5 | 0.00 | Dec 17, 2025 | In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and… | ||
| CVE-2023-31582 | Hig | 0.49 | 7.5 | 0.01 | Oct 25, 2023 | jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less. | ||
| CVE-2023-51775 | Med | 0.42 | 6.5 | 0.01 | Feb 29, 2024 | The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. |
- risk 0.49cvss 7.5epss 0.00
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and…
- risk 0.49cvss 7.5epss 0.01
jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.
- risk 0.42cvss 6.5epss 0.01
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.