GHSA-2c7c-3mj9-8fqh
Decryption of malicious PBES2 JWE objects can consume unbounded system resources
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
What each source reports
GitHub AdvisoriesNo score
Decryption of malicious PBES2 JWE objects can consume unbounded system resources
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
- Record
GHSA-2c7c-3mj9-8fqh- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVNo score
Decryption of malicious PBES2 JWE objects can consume unbounded system resources
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
- Record
GHSA-2c7c-3mj9-8fqh- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGO-2023-2334No score
Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
- Record
GO-2023-2334- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/go-jose/go-jose/v3Go | before 3.0.1 | 3.0.1 |
github.com/square/go-joseGo | before 2.6.2 | 2.6.2 |
github.com/square/go-joseGo | All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-2c7c-3mj9-8fqh is a vulnerability with no CVSS score yet in github.com/go-jose/go-jose/v3, published November 21, 2023. No source lists public exploit code. Fixed in github.com/go-jose/go-jose/v3 3.0.1.