Skip to content
Log inStart free trial

GHSA-c5q2-7r4c-mv6g CVE-2024-28180 GO-2024-2631

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Medium Go
Severity
4.3 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
1.96%
Chance of exploitation in the next 30 days. Higher than 80.27% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Fix
Available
3 packages have a fixed version

Description

Impact

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.

Patches

The problem is fixed in the following packages and versions:

  • github.com/go-jose/go-jose/v4 version 4.0.1
  • github.com/go-jose/go-jose/v3 version 3.0.3
  • gopkg.in/go-jose/go-jose.v2 version 2.6.3

The problem will not be fixed in the following package because the package is archived:

  • gopkg.in/square/go-jose.v2

Affected versions

Go

PackageVulnerableFixed in
github.com/go-jose/go-jose/v3
< 3.0.3
3.0.3
github.com/go-jose/go-jose/v4
< 4.0.1
4.0.1
gopkg.in/go-jose/go-jose.v2
< 2.6.3
2.6.3
gopkg.in/square/go-jose.v2
<= 2.6.0
 No fix yet
gopkg.in/square/go-jose.v2
all versions
 No fix yet

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/go-jose/go-jose/v3 Go → 3.0.3

go
go get github.com/go-jose/go-jose/v3@v3.0.3 && go mod tidy

github.com/go-jose/go-jose/v4 Go → 4.0.1

go
go get github.com/go-jose/go-jose/v4@v4.0.1 && go mod tidy

gopkg.in/go-jose/go-jose.v2 Go → 2.6.3

go
go get gopkg.in/go-jose/go-jose.v2@v2.6.3 && go mod tidy

Severity breakdown

CVSS 3.1 4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Weakness

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-mgcc-cww5-fp2q
Go JOSE: DoS when parsing JWKs that contain RSA keys
High Also affects github.com/go-jose/go-jose/v3
GHSA-vvm8-gf78-28g4
Go JOSE: Panics in JSON parsing
Medium Also affects github.com/go-jose/go-jose/v3
GHSA-4w3g-jfj2-cw2q
Go JOSE: Panic during CBC-HMAC processing
Medium Also affects github.com/go-jose/go-jose/v3
GHSA-78h2-9frx-2jm8
Go JOSE Panics in JWE decryption
High Also affects github.com/go-jose/go-jose/v3
GHSA-c6gw-w398-hv78
DoS in go-jose Parsing
Medium Also affects github.com/go-jose/go-jose/v3
EEF-CVE-2026-65627
Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
Not rated yet Same weakness, CWE-409
EEF-CVE-2026-97200
Unbounded response body buffering and decompression in hackney
Not rated yet Same weakness, CWE-409
EEF-CVE-2026-109584
HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
Not rated yet Same weakness, CWE-409

Credits: chenjj, zer0yu

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor