Medium severity · published Mar 9, 2024
CVE-2024-28180
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
4.3
CVSS
2%
EPSS
No
On KEV
Description
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
go-jose · go-jose
< 4.0.1; < 3.0.3; < 2.6.3 · source: vendor, NVD, CISA
FE
Fedora · Fedoraproject
38 through 40 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28180
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28180
Patch
https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298
Patch
https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a
Patch
https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502
Vendor Advisory
https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/
More from go-jose
7.5
CVE-2026-116587
Go JOSE: DoS when parsing JWKs that contain RSA keys
7.5
CVE-2026-34986
Go JOSE affect by a panic in JWE decryption
6.9
CVE-2026-116586
Go JOSE: Panics in JSON parsing
6.9
CVE-2026-116585
Go JOSE: Panic during CBC-HMAC processing
6.6
CVE-2025-27144
Go JOSE's Parsing Vulnerable to Denial of Service