CVE-2024-28176

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Mar 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-281799.8Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated we CVE-2024-28186.5An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versio CVE-2024-281804.3Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JW CVE-2024-281818.1turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has exist CVE-2024-281825.3nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading th CVE-2024-281835.7ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulne CVE-2024-281847.4WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbit CVE-2024-2818510.0Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, wh CVE-2024-281867.1FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, w CVE-2024-281877.2SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 CVE-2024-281885.3Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyt CVE-2024-2818910.0Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox.