CVE-2024-28176

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

4.9 MediumFix available

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.10%Up 2.1 points since Mar 9, 2024

What each source reports

CVE List Score used 4.9

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

Record: CVE-2024-28176
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2024-0938 4.9

Record: EUVD-2024-0938
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hhhv-q57g-882q 5.3

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. This allows an adversary to exploit specific scenarios where the compression ratio becomes exceptionally high. As a result, the length of the JWE token, which is determined by the compressed content's size, can land below application-defined limits. In such cases, other existing application level mechanisms for preventing resource exhaustion may be rendered ineffective.

Note that as per RFC 8725 compression of data SHOULD NOT be done before encryption, because such compressed data often reveals information about the plaintext. For this reason the v5.x major version of jose removed support for compressed payloads entirely and is therefore NOT affected by this advisory.

Impact

Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations.

Affected users

The impact is limited only to Node.js users utilizing the JWE decryption APIs to decrypt JWEs from untrusted sources.

You are NOT affected if any of the following applies to you

Your code uses jose version v5.x where JWE Compression is not supported anymore
Your code runs in an environment other than Node.js (e.g. Deno, CF Workers), which is the only runtime where JWE Compression is implemented out of the box
Your code does not use the JWE decryption APIs
Your code only accepts JWEs produced by trusted sources

Patches

v2.0.7 and v4.15.5 releases limit the decompression routine to only allow decompressing up to 250 kB of plaintext. In v4.x it is possible to further adjust this limit via the inflateRaw decryption option implementation. In v2.x it is possible to further adjust this limit via the inflateRawSyncLimit decryption option.

Workarounds

If you cannot upgrade and do not want to support compressed JWEs you may detect and reject these tokens early by checking the token's protected header

const { zip } = jose.decodeProtectedHeader(token)
if (zip !== undefined) {
  throw new Error('JWE Compression is not supported')
}

If you wish to continue supporting JWEs with compressed payloads in these legacy release lines you must upgrade (v1.x and v2.x to version v2.0.7, v3.x and v4.x to version v4.15.5) and review the limits put forth by the patched releases.

For more information

If you have any questions or comments about this advisory please open a discussion in the project's repository

Record: GHSA-hhhv-q57g-882q
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-400
Updated: 2026-11-02

NVD 4.9

Record: CVE-2024-28176
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 4.9

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

Record: CVE-2024-28176
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVGHSA-hhhv-q57g-882q 5.3

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

Impact

Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations.

Affected users

The impact is limited only to Node.js users utilizing the JWE decryption APIs to decrypt JWEs from untrusted sources.

You are NOT affected if any of the following applies to you

Your code uses jose version v5.x where JWE Compression is not supported anymore
Your code runs in an environment other than Node.js (e.g. Deno, CF Workers), which is the only runtime where JWE Compression is implemented out of the box
Your code does not use the JWE decryption APIs
Your code only accepts JWEs produced by trusted sources

Patches

Workarounds

If you cannot upgrade and do not want to support compressed JWEs you may detect and reject these tokens early by checking the token's protected header

const { zip } = jose.decodeProtectedHeader(token)
if (zip !== undefined) {
  throw new Error('JWE Compression is not supported')
}

For more information

If you have any questions or comments about this advisory please open a discussion in the project's repository

Record: GHSA-hhhv-q57g-882q
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-400
Updated: 2026-11-02

Show 21 moreShow less

OSVOESA-2025-1075 6.5

podman security update

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

Record: OESA-2025-1075
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVOESA-2025-1076 6.5

podman security update

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

Record: OESA-2025-1076
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2024:0045 8.3

Red Hat Security Advisory: OpenShift Container Platform 4.16.0 security update

Record: RHSA-2024:0045
CVSS 3.1: 8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:3826 5.3

Red Hat Security Advisory: podman security and bug fix update

Record: RHSA-2024:3826
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2024:3827 5.3

Red Hat Security Advisory: buildah security and bug fix update

Record: RHSA-2024:3827
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2024:3968 5.3

Red Hat Security Advisory: container-tools:rhel8 bug fix and enhancement update

Record: RHSA-2024:3968
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2024:5294 7.5

Red Hat Security Advisory: jose security update

Record: RHSA-2024:5294
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:9181 7.5

Red Hat Security Advisory: jose security update

Record: RHSA-2024:9181
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2024:5294 7.5

Moderate: jose security update

Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in Rocky Linux.

Security Fix(es):

jose: resource exhaustion (CVE-2024-28176)
jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2024:5294
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2024:9181 7.5

Moderate: jose security update

Security Fix(es):

jose: resource exhaustion (CVE-2024-28176)
jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

Record: RLSA-2024:9181
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-28176 4.9

Record: UBUNTU-CVE-2024-28176
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2024:3826 No score

Moderate: podman security and bug fix update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fixes:

podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
podman: jose: resource exhaustion (CVE-2024-28176)

Record: ALSA-2024:3826
Updated: 2026-11-02

OSVALSA-2024:3827 No score

Moderate: buildah security and bug fix update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
jose-go: improper handling of highly compressed data (CVE-2024-28180)
buildah: jose: resource exhaustion (CVE-2024-28176)

Record: ALSA-2024:3827
Updated: 2026-11-02

OSVALSA-2024:3968 No score

Moderate: container-tools:rhel8 bug fix and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)
podman: jose-go: resource exhaustion (CVE-2024-28176)
buildah: jose-go: resource exhaustion (CVE-2024-28176)
skopeo: jose-go: resource exhaustion (CVE-2024-28176)

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Record: ALSA-2024:3968
Updated: 2026-11-02

OSVALSA-2024:5294 No score

Moderate: jose security update

Security Fix(es):

jose: resource exhaustion (CVE-2024-28176)
jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:5294
Updated: 2026-11-02

OSVALSA-2024:9181 No score

Moderate: jose security update

Security Fix(es):

jose: resource exhaustion (CVE-2024-28176)
jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2024:9181
Updated: 2026-11-02

OSVCLSA-2026-1792163458 No score

TuxCare security update for jose (1 CVE)

TuxCare rebuilt jose to address 1 CVE. Fixed in 2.0.6-tuxcare.1.

Record: CLSA-2026-1792163458
Updated: 2026-11-02

OSVMGASA-2024-0343 No score

Updated buildah, podman, skopeo packages fix security vulnerabilities

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time. (CVE-2024-1753) A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks. (CVE-2024-3727) When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines. (CVE-2023-45290) Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180) jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5. (CVE-2024-28176) A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system. (CVE-2024-9341) go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. (CVE-2024-6104) A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files. (CVE-2024-9407)

Record: MGASA-2024-0343
Updated: 2026-11-02

OSVRLSA-2024:3826 No score

Moderate: podman security and bug fix update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fixes:

podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
podman: jose: resource exhaustion (CVE-2024-28176)

Record: RLSA-2024:3826
Updated: 2026-11-02

OSVRLSA-2024:3827 No score

Moderate: buildah security and bug fix update

Security Fix(es):

golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
jose-go: improper handling of highly compressed data (CVE-2024-28180)
buildah: jose: resource exhaustion (CVE-2024-28176)

Record: RLSA-2024:3827
Updated: 2026-11-02

OSVRLSA-2024:3968 No score

Moderate: container-tools:rhel8 bug fix and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)
podman: jose-go: resource exhaustion (CVE-2024-28176)
buildah: jose-go: resource exhaustion (CVE-2024-28176)
skopeo: jose-go: resource exhaustion (CVE-2024-28176)

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8 Release Notes linked from the References section.

Record: RLSA-2024:3968
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`jose` npm	3.0.0 to 4.15.4	4.15.5
`jose-node-cjs-runtime` npm	through 4.15.4	4.15.5
`jose-node-esm-runtime` npm	through 4.15.4	4.15.5
`jose` npm	before 2.0.7	2.0.7
`podman` AlmaLinux:9 From an advisory covering 3 CVEs	before 4:4.9.4-4.el9_4	4:4.9.4-4.el9_4
`podman-docker` AlmaLinux:9 From an advisory covering 3 CVEs	before 4:4.9.4-4.el9_4	4:4.9.4-4.el9_4
`podman-plugins` AlmaLinux:9 From an advisory covering 3 CVEs	before 4:4.9.4-4.el9_4	4:4.9.4-4.el9_4
`podman-remote` AlmaLinux:9 From an advisory covering 3 CVEs	before 4:4.9.4-4.el9_4	4:4.9.4-4.el9_4
`podman-tests` AlmaLinux:9 From an advisory covering 3 CVEs	before 4:4.9.4-4.el9_4	4:4.9.4-4.el9_4
`buildah` AlmaLinux:9 From an advisory covering 3 CVEs	before 2:1.33.7-2.el9_4	2:1.33.7-2.el9_4

Show 265 moreShow less

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-28176 is a medium vulnerability (CVSS 4.9) in Appsup-dart Jose, published March 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in jose 4.15.5.

References

Show 113 moreShow less