3 results · Feed
-
High 7.5
jose4j is vulnerable to DoS via compressed JWE content
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memor…
-
Medium 6.5
jose4j denial of service via specifically crafted JWE
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
-
High 7.5
jose4j uses weak cryptographic algorithm
jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.