CVE-2024-28180

4.3 mediumEPSS 2.0%

Medium (4.3). EPSS 2.0% chance of exploitation in the next 30 days. Fixed in github.com/go-jose/go-jose/v4 4.0.1.

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-409
Published: 2024-03-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fedoraproject:fedora
go-jose_project:go-jose

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-c5q2-7r4c-mv6g	Go	github.com/go-jose/go-jose/v4	<4.0.1	4.0.1
GHSA-c5q2-7r4c-mv6g	Go	github.com/go-jose/go-jose/v3	<3.0.3	3.0.3
GHSA-c5q2-7r4c-mv6g	Go	gopkg.in/go-jose/go-jose.v2	<2.6.3	2.6.3
GHSA-c5q2-7r4c-mv6g	Go	gopkg.in/square/go-jose.v2	<=2.6.0	no fix published
GO-2024-2631	Go	github.com/go-jose/go-jose/v4	<4.0.1	4.0.1
GO-2024-2631	Go	github.com/go-jose/go-jose/v3	<3.0.3	3.0.3
GO-2024-2631	Go	gopkg.in/go-jose/go-jose.v2	<2.6.3	2.6.3
GO-2024-2631	Go	gopkg.in/square/go-jose.v2	all versions	no fix published

References

Check your stack JSON