Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

4.3 CVSS

Vulnerability Description

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-28180

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from go-jose

View All →

CVE-2025-27144

Go JOSE's Parsing Vulnerable to Denial of Service

Medium 6.6

Affected Vendor

go-jose

View all reports →

Affected Software

go-jose

Vulnerable Versions:

< 4.0.1, < 3.0.3, < 2.6.3

Timeline

Official Publish: March 9th, 2024

Last Modified: February 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-409

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.