Skip to content
Fencer Vulns
high 7.5

CVE-2024-29371 json

jose4j is vulnerable to DoS via compressed JWE content

published 2025-12-17 10 mo ago modified 2026-10-27 12 d ago also GHSA-3677-xxcr-wjqv , EUVD-2024-26381

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits
0
none known

Summary

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Patch / fix

  • maven org.bitbucket.b_c:jose4j 0.9.6
  • jose4j_project jose4j 0.9.5
  • libjose4j-java Debian 14, Debian 13 0.9.6-1

debian advisories DEBIAN-CVE-2024-29371

  • eap8-jaxb jboss enterprise application platform 8.0 4.0.5-2.redhat_00001.1.el9eap
  • eap8-txw2 jboss enterprise application platform 8.0 4.0.5-2.redhat_00001.1.el9eap
  • eap8-xsom jboss enterprise application platform 8.0 4.0.5-2.redhat_00001.1.el9eap
  • eap8-angus jboss enterprise application platform 8.0 2.0.3-1.redhat_00001.1.el9eap
  • eap8-guava jboss enterprise application platform 8.0 33.0.0-1.jre_redhat_00002.1.el9eap
  • eap8-netty jboss enterprise application platform 8.0 4.1.108-1.Final_redhat_00001.1.el9eap
  • eap8-rngom jboss enterprise application platform 8.0 4.0.5-2.redhat_00001.1.el9eap
  • eap8-slf4j jboss enterprise application platform 8.0 2.0.13-1.redhat_00001.1.el9eap

red hat advisories RHSA-2026:33371RHSA-2024:5481RHSA-2024:5479

  • suse-manager-5.0-s390x-server-image Manager Server 5.0 5.0.7-7.37.12
  • suse-manager-5.0-x86_64-server-image Manager Server 5.0 5.0.7-7.37.12
  • suse-manager-5.0-aarch64-server-image Manager Server 5.0 5.0.7-7.37.12
  • suse-manager-5.0-ppc64le-server-image Manager Server 5.0 5.0.7-7.37.12
  • suse-manager-5.0-s390x-proxy-ssh-image Manager Retail Branch Server Extension 5.0, Manager Proxy 5.0 5.0.7-7.30.5
  • suse-manager-5.0-x86_64-proxy-ssh-image Manager Retail Branch Server Extension 5.0, Manager Proxy 5.0 5.0.7-7.30.5
  • suse-manager-5.0-aarch64-proxy-ssh-image Manager Retail Branch Server Extension 5.0, Manager Proxy 5.0 5.0.7-7.30.5
  • suse-manager-5.0-ppc64le-proxy-ssh-image Manager Retail Branch Server Extension 5.0, Manager Proxy 5.0 5.0.7-7.30.5

suse advisories SUSE-SU-2026:1010-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-29371 updated cvss 7.5

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression

  • Red Hat OpenShift Developer Tools and Services jenkins-2-plugins Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9 Red Hat build of Apicurio Registry 2 jose4j Red Hat build of Apicurio Registry 3 jose4j
    affected: no fix available
  • Red Hat build of Debezium 2 jose4j Red Hat build of Debezium 3 jose4j Red Hat Fuse 7 jose4j
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 8 jose4j, org.bitbucket.b_c-jose4j, org.jboss.eap-jboss-eap-xp
    affected: no fix available
  • Red Hat OpenShift Dev Spaces devspaces-tech-preview/idea-rhel9 Red Hat Process Automation 7 jose4j Red Hat Single Sign-On 7 jose4j
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4 1776764096, ocp-tools-4/jenkins-rhel8 1786628667
    fixed: vendor fix RHSA-2026:10209
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4 1776764096, ocp-tools-4/jenkins-rhel8 1786628681
    fixed: vendor fix RHSA-2026:10201
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4 1776762347, ocp-tools-4/jenkins-rhel8 1786533561
    fixed: vendor fix RHSA-2026:10211
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4 1776762347, ocp-tools-4/jenkins-rhel8 1786533565
    fixed: vendor fix RHSA-2026:10204
show 14 more
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4 1776944215, ocp-tools-4/jenkins-rhel9 1787125166
    fixed: vendor fix RHSA-2026:60251
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4 1776944215, ocp-tools-4/jenkins-rhel9 1787124635
    fixed: vendor fix RHSA-2026:10213
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4 1776944215, ocp-tools-4/jenkins-rhel9 1787125069
    fixed: vendor fix RHSA-2026:10215
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4 1776944215, ocp-tools-4/jenkins-rhel9 1787124632
    fixed: vendor fix RHSA-2026:10206
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4 1776944215, ocp-tools-4/jenkins-rhel9 1787124925
    fixed: vendor fix RHSA-2026:10205
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4 1776944215, ocp-tools-4/jenkins-rhel9 1787125311
    fixed: vendor fix RHSA-2026:10199
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1787124779
    fixed: vendor fix RHSA-2026:60256
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-modules 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-javadocs 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk8 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk11 7.3.18-3.GA_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2026:33371
  • Red Hat JBoss Enterprise Application Platform 8
    fixed: vendor fix RHSA-2024:5482
  • Red Hat JBoss Enterprise Application Platform 8.1.0 jose4j 0.9.6.redhat-00001
    fixed: vendor fix RHSA-2025:17299
  • Red Hat Streams for Apache Kafka 2.9.4
    fixed: vendor fix RHSA-2026:34608
  • Red Hat Streams for Apache Kafka 3.2.0
    fixed: vendor fix RHSA-2026:13571
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4 1776760341, ocp-tools-4/jenkins-agent-base-rhel8 1786628706 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4 1776760341, ocp-tools-4/jenkins-agent-base-rhel8 1786628711 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4 1776760341, ocp-tools-4/jenkins-agent-base-rhel8 1786628748 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4 1776760341, ocp-tools-4/jenkins-agent-base-rhel8 1786628726 Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4 1776944183, ocp-tools-4/jenkins-agent-base-rhel9 1787124634 Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4 1776944183, ocp-tools-4/jenkins-agent-base-rhel9 1787124986
    +6 more products
    Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4 1776944183, ocp-tools-4/jenkins-agent-base-rhel9 1787124633 Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4 1776944183, ocp-tools-4/jenkins-agent-base-rhel9 1787124663 Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4 1776944183, ocp-tools-4/jenkins-agent-base-rhel9 1787125493 Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4 1776944183, ocp-tools-4/jenkins-agent-base-rhel9 1787125679 Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-agent-base-rhel9 1787125563 Red Hat build of Apache Camel - HawtIO 4 jose4j
    not affected: vulnerable code not present
  • Red Hat build of Apache Camel for Spring Boot 4 jose4j
    not affected: vulnerable code not in execute path

6 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
10 mo ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bitbucket.org https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.bitbucket.b_c:jose4j
<0.9.6
0.9.6

Classification

Weakness
  • CWE-1259 Improper Restriction of Security Token Assignment

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.