What’s Vulnerable › Vulnerabilities

CVE-2023-50658

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-29 · updated 2026-06-17
• Weakness: CWE-770

Description

The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Affected products

• Dvsekhvalnov Jose2Go: before 1.6.0 — fixed in 1.6.0

How to fix

Upgrade to a fixed version: Dvsekhvalnov Jose2Go 1.6.0. Check the vendor advisory for mitigations.

References

• https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317
• https://github.com/dvsekhvalnov/jose2go/compare/v1.5.0...v1.6.0
• https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317
• https://github.com/dvsekhvalnov/jose2go/compare/v1.5.0...v1.6.0

Get alerted when CVE-2023-50658 or the next vulnerability affects your stack