Description
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has
been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| panva | jose | >= 3.0.0, <= 4.15.4, < 2.0.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | node-jose | No fix yet | — |
| Ubuntu 24.04 LTS | node-jose | No fix yet | — |
| Ubuntu 22.04 LTS | node-jose | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | buildah +1 | 2:1.33.7-2.el9_4 | RHSA-2024:3827 |
| RHEL 9 | jose +2 | 14-1.el9 | RHSA-2024:9181 |
| RHEL 9 | podman +4 | 4:4.9.4-4.el9_4 | RHSA-2024:3826 |
| RHEL 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | buildah +1 | 2:1.33.7-2.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | cockpit-podman | 84.1-1.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | conmon | 3:2.1.10-1.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | containers-common | 2:1-81.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | crit +4 | 3.18-5.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | crun | 1.14.3-2.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | jose +2 | 10-2.el8_10.3 | RHSA-2024:5294 |
| RHEL 8 | libslirp +1 | 4.4.0-2.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | netavark | 2:1.10.3-1.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | podman +6 | 4:4.9.4-3.module+el8.10.0+21974+acd2159c | RHSA-2024:3968 |
| RHEL 8 | python-podman +1 | 4.9.0-1.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | runc | 1:1.1.12-1.module+el8.10.0+21974+acd2159c | RHSA-2024:3968 |
| RHEL 8 | skopeo +1 | 2:1.14.3-2.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | slirp4netns | 1.2.3-1.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | toolbox +1 | 0.0.99.5-2.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
| RHEL 8 | udica | 0.2.6-21.module+el8.10.0+21962+8143777b | RHSA-2024:3968 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openshift Ironic 4 | python-eventlet +1 | 0.33.1-6.el9 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | butane +1 | 0.21.0-1.rhaos4.16.el8 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | cri-o | 1.29.5-5.rhaos4.16.git7032128.el8 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | cri-tools | 1.29.0-3.1.el8 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | ignition +1 | 2.18.0-2.1.rhaos4.16.el9 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | openshift +5 | 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | openshift-prometheus-promu +1 | 0.15.0-15.2.gitd5383c5.el9 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | ose-aws-ecr-image-credential-provider | 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el8 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | ose-azure-acr-image-credential-provider | 4.16.0-202404301345.p0.g0e95532.assembly.stream.el8 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | ose-gcp-gcr-image-credential-provider | 4.16.0-202404181812.p0.g26b43df.assembly.stream.el8 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | podman +6 | 4:4.9.4-5.1.rhaos4.16.el8 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | runc | 4:1.1.12-3.1.rhaos4.16.el8 | RHSA-2024:0045 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.14.4-1.rhaos4.16.el8 | RHSA-2024:0045 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | buildah +1 | 2:1.33.7-2.el9_4 | ALSA-2024:3827 |
| AlmaLinux 9 | jose +2 | 14-1.el9 | ALSA-2024:9181 |
| AlmaLinux 9 | podman +4 | 4:4.9.4-4.el9_4 | ALSA-2024:3826 |
| AlmaLinux 8 | aardvark-dns | 2:1.10.0-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux 8 | buildah +1 | 2:1.33.7-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux 8 | cockpit-podman | 84.1-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux 8 | conmon | 3:2.1.10-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux 8 | container-selinux | 2:2.229.0-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux 8 | containernetworking-plugins | 1:1.4.0-2.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux 8 | containers-common | 2:1-81.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux 8 | crit +3 | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux 8 | criu-devel | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux 8 | crun | 1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux 8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux 8 | jose +2 | 10-2.el8_10.3 | ALSA-2024:5294 |
| AlmaLinux 8 | libslirp +1 | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux 8 | netavark | 2:1.10.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux 8 | podman +6 | 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux 8 | python3-podman | 4.9.0-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux 8 | runc | 1:1.1.12-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux 8 | skopeo +1 | 2:1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux 8 | slirp4netns | 1.2.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux 8 | toolbox +1 | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux 8 | udica | 0.2.6-21.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | buildah | 2:1.33.7-2.el9_4 | RLSA-2024:3827 |
| Rocky Linux 9 | jose | 14-1.el9 | RLSA-2024:9181 |
| Rocky Linux 9 | podman | 4:4.9.4-4.el9_4 | RLSA-2024:3826 |
| Rocky Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | buildah | 2:1.33.7-2.module+el8.10.0+1829+9bb2696f | RLSA-2024:3968 |
| Rocky Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | containers-common | 2:1-81.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | criu | 3.18-5.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | crun | 1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | jose | 10-2.el8_10.3 | RLSA-2024:5294 |
| Rocky Linux 8 | libslirp | 4.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | podman | 4:4.9.4-3.module+el8.10.0+1829+9bb2696f | RLSA-2024:3968 |
| Rocky Linux 8 | python-podman | 4.9.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | skopeo | 2:1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | toolbox | 0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2024:3968 |
| Rocky Linux 8 | udica | 0.2.6-21.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | buildah +1 | 2:1.33.7-2.0.1.el9_4 | ELSA-2024-3827 |
| Oracle Linux 9 | jose +2 | 14-1.el9 | ELSA-2024-9181 |
| Oracle Linux 9 | podman +4 | 4:4.9.4-4.0.1.el9_4 | ELSA-2024-3826 |
| Oracle Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | buildah +1 | 2:1.33.7-2.module+el8.10.0+90352+16362864 | ELSA-2024-3968 |
| Oracle Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | containers-common | 2:1-81.0.1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | crit +4 | 3.18-5.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968 |
| Oracle Linux 8 | crun | 1.14.3-2.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | jose +2 | 10-2.el8_10.3 | ELSA-2024-5294 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-2.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968 |
| Oracle Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | podman +6 | 4:4.9.4-3.0.1.module+el8.10.0+90352+16362864 | ELSA-2024-3968 |
| Oracle Linux 8 | python3-podman | 4.9.0-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | skopeo +1 | 2:1.14.3-2.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968 |
| Oracle Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968 |
| Oracle Linux 8 | udica | 0.2.6-21.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | sqlpad +1 | 7.4.1-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | jose | >= 3.0.0, < 4.15.5 | 4.15.5 | GHSA-hhhv-q57g-882q |
| npm | jose | < 2.0.7 | 2.0.7 | GHSA-hhhv-q57g-882q |
| npm | jose-node-cjs-runtime | < 4.15.5 | 4.15.5 | GHSA-hhhv-q57g-882q |
| npm | jose-node-esm-runtime | < 4.15.5 | 4.15.5 | GHSA-hhhv-q57g-882q |
Advisories 23
- ALSA-2024:3826 Moderate: podman security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3827 Moderate: buildah security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:9181 Moderate: jose security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3968 Moderate: container-tools:rhel8 bug fix and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:5294 Moderate: jose security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:0045 Red Hat Security Advisory: OpenShift Container Platform 4.16.0 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:9181 Red Hat Security Advisory: jose security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:5294 Red Hat Security Advisory: jose security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:3968 Red Hat Security Advisory: container-tools:rhel8 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:3827 Red Hat Security Advisory: buildah security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:3826 Red Hat Security Advisory: podman security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RLSA-2024:3968 Moderate: container-tools:rhel8 bug fix and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:3826 Moderate: podman security and bug fix update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:3827 Moderate: buildah security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:9181 Moderate: jose security update Rocky Linux Security Advisories · Oct 9, 2025
- WID-SEC-2024-1474 Red Hat OpenShift Container Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2025
- RLSA-2024:5294 Moderate: jose security update Rocky Linux Security Advisories · May 7, 2025
- WID-SEC-2024-0767 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 27, 2024
- ELSA-2024-9181 Moderate: jose security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 14, 2024
- ELSA-2024-5294 Moderate: jose security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 13, 2024
- ELSA-2024-3968 Moderate: container-tools:ol8 bug fix and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 18, 2024
- ELSA-2024-3826 Moderate: podman security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 11, 2024
- ELSA-2024-3827 Moderate: buildah security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 11, 2024
References
- https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q
- https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314
- https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/