In jose4j before 0.9.5, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
References
| Link | Resource |
|---|---|
| https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack | Exploit Issue Tracking Mitigation |
| https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack | Exploit Issue Tracking Mitigation |
Configurations
History
05 Jan 2026, 15:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jose4j_project:jose4j:*:*:*:*:*:*:*:* | |
| First Time |
Jose4j Project jose4j
Jose4j Project |
|
| References | () https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack - Exploit, Issue Tracking, Mitigation |
17 Dec 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-1259 | |
| References | () https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack - |
17 Dec 2025, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-17 16:16
Updated : 2026-01-05 15:12
NVD link : CVE-2024-29371
Mitre link : CVE-2024-29371
CVE.ORG link : CVE-2024-29371
JSON object : View
Products Affected
jose4j_project
- jose4j
CWE
CWE-1259
Improper Restriction of Security Token Assignment