CVE-2024-29371

Published: Dec 17, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Affected (1)

Products: Jose4j Project: Jose4j

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jose4j Project Jose4j	Before 0.9.5

Related CWEs

Improper Restriction of Security Token Assignment

The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

References (2)

https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack

Source: cve@mitre.org

ExploitIssue TrackingMitigation

https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitIssue TrackingMitigation

Timeline

No history available yet.