Executive brief
Decryption of malicious PBES2 JWE objects can consume unbounded system resources
Affected products
- Go github.com/square/go-jose
- Go github.com/go-jose/go-jose/v3
Junglewise Threat Intelligence
Decryption of malicious PBES2 JWE objects can consume unbounded system resources
Severity: info ยท Published 2023-11-21
Technologies: github.com/square/go-jose (Go), github.com/go-jose/go-jose/v3 (Go). Vendors: Go.
Related threats
- Go JOSE denial of service via panic in JWE decryption
- GO-2025-3485 - DoS in go-jose Parsing in github.com/go-jose/go-jose
- GO-2024-2631 - Decompression bomb vulnerability in github.com/go-jose/go-jose
- GO-2023-2334 - Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3
- Square go-jose integer overflow in CBC-HMAC decryption