Skip to content
OpenAdvisories
High · 7.5 CVE-2024-29371 EUVD-2024-26381GHSA-3677-xxcr-wjqv

jose4j is vulnerable to DoS via compressed JWE content

Published Dec 17, 2025 · Updated Jan 23, 2026 · Assigned by mitre

Package: confluent-common-docker Package: kafka_exporter-strimzi-compat Package: kafka-strimzi-compat Package: libjose4j-java Package: libjose4j-java Package: org.bitbucket.b_c:jose4j Package: prometheus-jmx-exporter-strimzi-compat Package: strimzi-kafka-operator Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-base Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libjose4j-java 0.9.6-1 —
Debian 13 libjose4j-java 0.9.6-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libjose4j-java No fix yet —
Ubuntu 26.04 LTS libjose4j-java No fix yet —
Ubuntu 25.10 libjose4j-java No fix yet —
Ubuntu 24.04 LTS libjose4j-java No fix yet —
Ubuntu 22.04 LTS libjose4j-java No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-apache-cxf +3 3.4.10-4.SP2_redhat_00004.1.el7eap RHSA-2026:33371
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 2.0.41-8.SP9_redhat_00001.1.el7eap RHSA-2026:33371
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +4 7.3.18-3.GA_redhat_00001.1.el7eap RHSA-2026:33371
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.21.0-5.redhat_00052.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-angus +1 2.0.3-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-angus-activation 2.0.1-3.redhat_00006.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-beanutils 1.9.4-13.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-cli 1.4.0-2.redhat_00003.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-codec 1.15.0-6.redhat_00016.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.0.4-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-mime4j +2 0.8.11-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-sshd 2.12.1-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.78.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-byte-buddy 1.14.18-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-caffeine 3.1.8-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-cxf-xjc-dv +5 4.0.0-5.redhat_00003.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.3.0-2.GA_redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-guava +1 33.0.0-1.jre_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-guava-failureaccess 1.0.2-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-hal-console 3.6.19-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-hornetq +3 2.4.9-4.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-3.redhat_00005.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-client 4.5.14-4.redhat_00012.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-core 4.4.16-4.redhat_00010.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-infinispan +20 14.0.30-2.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-mail +1 2.1.3-1.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-servlet-api 6.0.0-5.redhat_00006.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-websocket +2 2.1.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jandex 3.0.8-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jasypt 1.9.3-4.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-java-classmate 1.5.1-3.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.5-2.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jboss-metadata +5 16.0.0-3.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jboss-openjdk-orb 10.1.0-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.1.0-1.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-joda-time 2.12.7-1.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jsf-impl 4.0.7-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-mod_cluster 2.0.3-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-neethi 3.2.0-1.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-netty +14 4.1.108-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-netty-xnio-transport 0.1.10-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-opensaml +13 4.2.0-4.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-parsson 1.1.5-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-reactivex-rxjava 3.1.8-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-resteasy +15 6.2.7-2.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.13-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-stax2-api 4.2.2-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-velocity +1 2.3.0-3.redhat_00009.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-weld-ejb +6 5.1.2-2.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly +3 8.0.3-9.GA_redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly-discovery +1 1.3.0-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.2.6-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wsdl4j 1.6.3-5.redhat_00008.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wss4j +6 3.0.3-1.redhat_00008.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-xml-security 3.0.4-1.redhat_00005.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-yasson 3.0.3-3.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server 5.0 suse-manager-5.0-s390x-server-attestation-image +3 5.0.7-6.34.5 SUSE-SU-2026:1010-1
SUSE Manager Server 5.0 suse-manager-5.0-s390x-server-hub-xmlrpc-api-image +3 5.0.7-6.30.7 SUSE-SU-2026:1010-1
SUSE Manager Server 5.0 suse-manager-5.0-s390x-server-image +3 5.0.7-7.37.12 SUSE-SU-2026:1010-1
SUSE Manager Server 5.0 suse-manager-5.0-s390x-server-migration-14-16-image +3 5.0.7-7.30.7 SUSE-SU-2026:1010-1
SUSE Manager Retail Branch Server Extension 5.0 suse-manager-5.0-s390x-proxy-httpd-image +3 5.0.7-7.30.13 SUSE-SU-2026:1010-1
SUSE Manager Retail Branch Server Extension 5.0 suse-manager-5.0-s390x-proxy-salt-broker-image +3 5.0.7-7.32.15 SUSE-SU-2026:1010-1
SUSE Manager Retail Branch Server Extension 5.0 suse-manager-5.0-s390x-proxy-squid-image +3 5.0.7-7.30.6 SUSE-SU-2026:1010-1
SUSE Manager Retail Branch Server Extension 5.0 suse-manager-5.0-s390x-proxy-ssh-image +7 5.0.7-7.30.5 SUSE-SU-2026:1010-1
SUSE Manager Proxy 5.0 suse-manager-5.0-s390x-proxy-httpd-image +3 5.0.7-7.30.13 SUSE-SU-2026:1010-1
SUSE Manager Proxy 5.0 suse-manager-5.0-s390x-proxy-salt-broker-image +3 5.0.7-7.32.15 SUSE-SU-2026:1010-1
SUSE Manager Proxy 5.0 suse-manager-5.0-s390x-proxy-squid-image +3 5.0.7-7.30.6 SUSE-SU-2026:1010-1
SUSE Manager Proxy 5.0 suse-manager-5.0-s390x-proxy-ssh-image +7 5.0.7-7.30.5 SUSE-SU-2026:1010-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling confluent-common-docker 7.6.9-r1 —
Wolfi rolling kafka-strimzi-compat +11 0.49.1-r1 —
Wolfi rolling strimzi-kafka-operator-kafka-thirdparty-libs-cc 0.49.1-r5 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.bitbucket.b_c:jose4j < 0.9.6 0.9.6 GHSA-3677-xxcr-wjqv

Advisories 10

References