CVE-2024-28122 - Vulnerability Details - OpenCVE

JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00033.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Lestrrat-go	Jwx

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29
https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21
https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259
https://nvd.nist.gov/vuln/detail/CVE-2024-28122
https://www.cve.org/CVERecord?id=CVE-2024-28122

History

Wed, 16 Apr 2025 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Lestrrat-go Lestrrat-go jwx
CPEs		cpe:2.3:a:lestrrat-go:jwx:1.2.0:::::::* cpe:2.3:a:lestrrat-go:jwx:2.0.0:::::::*
Vendors & Products		Lestrrat-go Lestrrat-go jwx
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-03-09T00:45:50.129Z

Updated: 2025-04-16T15:49:42.161Z

Reserved: 2024-03-04T14:19:14.060Z

Link: CVE-2024-28122

Vulnrichment

Updated: 2024-08-02T00:48:48.987Z

NVD

Status : Awaiting Analysis

Published: 2024-03-09T01:15:06.940

Modified: 2024-11-21T09:05:51.847

Link: CVE-2024-28122

Redhat

Severity : Moderate

Publid Date: 2024-03-09T00:00:00Z

Links: CVE-2024-28122 - Bugzilla

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-28122", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-04T14:19:14.060Z", "datePublished": "2024-03-09T00:45:50.129Z", "dateUpdated": "2025-04-16T15:49:42.161Z"}, "containers": {"cna": {"title": " JWX vulnerable to a denial of service attack using compressed JWE message", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259"}, {"name": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "tags": ["x_refsource_MISC"], "url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29"}, {"name": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "tags": ["x_refsource_MISC"], "url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21"}], "affected": [{"vendor": "lestrrat-go", "product": "jwx", "versions": [{"version": ">= 2.0.0, < 2.0.21", "status": "affected"}, {"version": ">= 1.2.0, < 1.2.29", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-09T00:45:50.129Z"}, "descriptions": [{"lang": "en", "value": " JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21."}], "source": {"advisory": "GHSA-hj3v-m684-v259", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "lestrrat-go", "product": "jwx", "cpes": ["cpe:2.3:a:lestrrat-go:jwx:2.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.0.0", "status": "affected", "lessThan": "2.0.21", "versionType": "custom"}]}, {"vendor": "lestrrat-go", "product": "jwx", "cpes": ["cpe:2.3:a:lestrrat-go:jwx:1.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.2.0", "status": "affected", "lessThan": "1.2.29", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-11T16:48:06.985221Z", "id": "CVE-2024-28122", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T15:49:42.161Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:48.987Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259"}, {"name": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29"}, {"name": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "name": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "name": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "name": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:48.987Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-28122", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-11T16:48:06.985221Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:lestrrat-go:jwx:2.0.0:*:*:*:*:*:*:*"], "vendor": "lestrrat-go", "product": "jwx", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.0.21", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:lestrrat-go:jwx:1.2.0:*:*:*:*:*:*:*"], "vendor": "lestrrat-go", "product": "jwx", "versions": [{"status": "affected", "version": "1.2.0", "lessThan": "1.2.29", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-23T14:50:35.480Z"}}], "cna": {"title": " JWX vulnerable to a denial of service attack using compressed JWE message", "source": {"advisory": "GHSA-hj3v-m684-v259", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "lestrrat-go", "product": "jwx", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.0.21"}, {"status": "affected", "version": ">= 1.2.0, < 1.2.29"}]}], "references": [{"url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "name": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "name": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "name": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": " JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-09T00:45:50.129Z"}}}, "cveMetadata": {"cveId": "CVE-2024-28122", "state": "PUBLISHED", "dateUpdated": "2025-04-16T15:49:42.161Z", "dateReserved": "2024-03-04T14:19:14.060Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-09T00:45:50.129Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": " JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21."}, {"lang": "es", "value": "JWX es un m\u00f3dulo Go que implementa varias tecnolog\u00edas JWx (JWA/JWE/JWK/JWS/JWT, tambi\u00e9n conocidas como JOSE). Esta vulnerabilidad permite a un atacante con una clave p\u00fablica confiable provocar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) mediante la creaci\u00f3n de un token JSON Web Encryption (JWE) malicioso con una relaci\u00f3n de compresi\u00f3n excepcionalmente alta. Este problema se solucion\u00f3 en las versiones 1.2.29 y 2.0.21."}], "id": "CVE-2024-28122", "lastModified": "2024-11-21T09:05:51.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-03-09T01:15:06.940", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29"}, {"source": "security-advisories@github.com", "url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21"}, {"source": "security-advisories@github.com", "url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}