Executive brief
Decompression bomb vulnerability in github.com/go-jose/go-jose
Affected products
- Go gopkg.in/square/go-jose.v2
- Go github.com/go-jose/go-jose/v4
- Go github.com/go-jose/go-jose/v3
- Go gopkg.in/go-jose/go-jose.v2
Junglewise Threat Intelligence
CVE-2024-28180: GO-2024-2631 - Decompression bomb vulnerability in github.com/go-jose/go-jose
CVE-2024-28180 · Severity: low · CVSS 3.1 · Published 2024-03-15
Technologies: github.com/go-jose/go-jose/v4 (Go), github.com/go-jose/go-jose/v3 (Go). Vendors: Go.
Related threats
- Go JOSE denial of service via panic in JWE decryption
- GO-2025-3485 - DoS in go-jose Parsing in github.com/go-jose/go-jose
- Decryption of malicious PBES2 JWE objects can consume unbounded system resources
- GO-2023-2334 - Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3