{"id":"CVE-2023-50658","aliases":["AZL-35422","AZL-35426","DEBIAN-CVE-2023-50658","EUVD-2024-0527","GHSA-6294-6rgp-fr7r","GHSA-mhpq-9638-x6pw","GO-2023-2409","UBUNTU-CVE-2023-50658"],"status":"published","title":"jose2go vulnerable to denial of service via large p2c value","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00824,"percentile":0.57641,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2023-12-20T17:35:00Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Go","package":"github.com/dvsekhvalnov/jose2go","fixed_in":["1.6.0","1.5.1-0.20231206184617-48ba0b76bc88"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"telegraf","fixed_in":["1.29.4-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.29.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-dvsekhvalnov-jose2go","fixed_in":["1.9-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/dvsekhvalnov/jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.4-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-1","1.5-1","1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-1","1.5-1","1.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-1"}]}],"versions":["1.5-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/dvsekhvalnov/jose2go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/dvsekhvalnov/jose2go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.1-0.20231206184617-48ba0b76bc88"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1","1.9-1","1.11.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-dvsekhvalnov-jose2go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1"]}],"products":[{"vendor":"dvsekhvalnov","product":"jose2go"}],"references":[{"url":"https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/dvsekhvalnov/jose2go/compare/v1.5.0...v1.6.0","tags":["x_transferred","Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50658","tags":["web","advisory"]},{"url":"https://github.com/dvsekhvalnov/jose2go/issues/31","tags":["web"]},{"url":"https://www.blackhat.com/us-23/briefings/schedule/#three-new-attacks-against-json-web-tokens-31695","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2409","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6294-6rgp-fr7r"},{"url":"https://github.com/advisories/GHSA-mhpq-9638-x6pw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50658.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-50658","tags":["advisory"]},{"url":"https://github.com/dvsekhvalnov/jose2go","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-50658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-50658","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-50658","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2023-12-25T00:00:00Z","modified":"2024-08-02T22:16:47.116Z","updated_at":"2026-11-02T14:35:34.923818Z"}],"euvd":[{"id":"EUVD-2024-0527","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2023-12-25T00:00:00Z","modified":"2024-08-02T22:16:47Z","updated_at":"2026-11-03T03:26:07.661682Z"}],"ghsa":[{"id":"GHSA-6294-6rgp-fr7r","title":"jose2go vulnerable to denial of service via large p2c value","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T03:33:14Z","modified":"2026-02-03T16:43:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:21.558748Z"},{"id":"GHSA-mhpq-9638-x6pw","title":"Duplicate Advisory: Denial of service when decrypting attack controlled input in github.com/dvsekhvalnov/jose2go","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6294-6rgp-fr7r. This link is maintained to preserve external references.\n\n## Original Description\n\nAn attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service.","status":"withdrawn","published":"2023-12-20T20:31:57Z","modified":"2026-02-03T17:53:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:21.558748Z"}],"nvd":[{"id":"CVE-2023-50658","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T01:42:01.123Z","modified":"2026-06-17T06:39:47.34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:09:07.077422Z"}],"osv":[{"id":"AZL-35422","title":"CVE-2023-50658 affecting package telegraf for versions less than 1.29.4-1","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T01:42:01Z","modified":"2026-04-21T04:28:04.088915Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35426","title":"CVE-2023-50658 affecting package telegraf for versions less than 1.29.4-1","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T01:42:01Z","modified":"2026-04-21T04:32:22.576991Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"DEBIAN-CVE-2023-50658","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T01:42:01.123Z","modified":"2026-10-26T18:03:07.608378987Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"GHSA-6294-6rgp-fr7r","title":"jose2go vulnerable to denial of service via large p2c value","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T03:33:14Z","modified":"2026-09-10T03:50:05.399928431Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"GHSA-mhpq-9638-x6pw","title":"Duplicate Advisory: Denial of service when decrypting attack controlled input in github.com/dvsekhvalnov/jose2go","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6294-6rgp-fr7r. This link is maintained to preserve external references.\n\n## Original Description\n\nAn attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service.","status":"withdrawn","published":"2023-12-20T20:31:57Z","modified":"2026-09-10T03:49:59.645296104Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"UBUNTU-CVE-2023-50658","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T01:42:00Z","modified":"2026-10-17T12:57:22.152681672Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CVE-2023-50658","description":"The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2023-12-25T00:00:00Z","modified":"2026-10-28T02:30:33.256512716Z","updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"GO-2023-2409","title":"Denial of service when decrypting attacker controlled input in github.com/dvsekhvalnov/jose2go","description":"An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service.","status":"published","published":"2023-12-20T17:35:00Z","modified":"2026-02-04T03:28:14.460734Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}