CVE-2024-29371

HighCVSS 7.5/10Last modified Oct 27, 2026

Description

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1259

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attackExploit, Issue Tracking, Mitigation
https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attackExploit, Issue Tracking, Mitigation

Timeline

Published: Dec 17, 2025
Last modified: Oct 27, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-293746.1A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.CVE-2024-293759.8CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to t CVE-2024-293766.4Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.CVE-2024-29386.5A vulnerability was found in Campcodes Online Examination System 1.0. It has been rated as critical. This issue affects some unknown process CVE-2024-293847.5An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information via the content.js and parseCSSRules funct CVE-2024-293859.0DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.CVE-2024-293865.4projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceExport.php.CVE-2024-293878.8projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/print.php.CVE-2024-29396.1A vulnerability classified as problematic has been found in Campcodes Online Examination System 1.0. Affected is an unknown function of the CVE-2024-293907.3Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-CVE-2024-293925.4Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.CVE-2024-293997.6An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a cr