What’s Vulnerable › Vulnerabilities
CVE-2024-28180: Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-03-09 · updated 2026-06-17
- Weakness: CWE-409
Description
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
Affected products
- Fedoraproject Fedora: from 38 through 40
- go-jose: from 2.0.0 before 2.6.3; from 3.0.0 before 3.0.3; from 4.0.0 before 4.0.1 — fixed in 2.6.3, 3.0.3, 4.0.1
- Go Github.Com/Go-Jose/Go-Jose/V3: before 3.0.3 — fixed in 3.0.3
- Go Github.Com/Go-Jose/Go-Jose/V4: before 4.0.1 — fixed in 4.0.1
- Gopkg.In/Go-Jose/Go-Jose.V2: before 2.6.3 — fixed in 2.6.3
- Gopkg.In/Square/Go-Jose.V2: all versions
How to fix
Upgrade to a fixed version: go-jose 2.6.3, 3.0.3, 4.0.1; Go Github.Com/Go-Jose/Go-Jose/V3 3.0.3; Go Github.Com/Go-Jose/Go-Jose/V4 4.0.1; Gopkg.In/Go-Jose/Go-Jose.V2 2.6.3. Check the vendor advisory for mitigations.
References
- https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298
- https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a
- https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502
- https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/
Get alerted when CVE-2024-28180 or the next vulnerability affects your stack