CVE-2024-28180: Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Analyzed

AliasesSUSE-SU-2024:2754-1SUSE-SU-2025:0066-1RHSA-2024:2071+522 more

Published 09-03-2024Last modified 13-02-2025

Vulnerability summary

CVE-2024-28180 is a medium (CVSS 4.3) vulnerability in fedoraproject fedora. EPSS estimates a 1.96% chance of exploitation in the next 30 days, higher than 80.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

1.96%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 33 · Related 131

MGASA-2024-0343 OPENSUSE-SU-2024:13905-1 OPENSUSE-SU-2024:13952-1 OPENSUSE-SU-2025:14663-1 OPENSUSE-SU-2025:15305-1 OPENSUSE-SU-2025:15529-1+94 more

Showing 100 of 148.

Timeline

09-03-2024
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

CVSS metrics

8 scores · 8 sources · 1 version

v3.14.3

EPSS trend

Probability

1.96%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.96% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-409Improper Handling of Highly Compressed Data (Data Amplification)The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r7
apko< 0.14.0-r3
argo-workflows< 3.5.5-r2
argo-workflows-fips< 3.5.5-r2
bank-vaults< 1.32.0-r2 | < 1.20.4-r8

bank-vaults-fips< 1.20.4-r6
bank-vaults-template-fips< 1.20.4-r6
caddy-fips< 2.8.4-r0
caddy-man< 2.8.4-r0
cilium-1.15< 1.15.2-r0
cilium-1.15-clustermesh-apiserver< 1.15.2-r0
cilium-1.15-container-init< 1.15.2-r0
cilium-1.15-container-init-compat< 1.15.2-r0
cilium-1.15-hubble-relay< 1.15.2-r0
cilium-1.15-iptables< 1.15.2-r0
cilium-1.15-operator-aws< 1.15.2-r0
cilium-1.15-operator-generic< 1.15.2-r0
cloudflared< 2024.1.0-r4
consul-1.17< 1.17.4-r4
consul-1.17-fips< 1.17.4-r5
cosign< 2.2.3-r2
cosign-fips< 2.2.3-r2
dex< 2.38.0-r1
dex-fips< 2.38.0-r2
dex-fips-iamguarded-compat< 2.38.0-r2
dex-k8s-authenticatorAll versions (No fix recorded)
dgraph< 24.0.0-r0
eks-distro-kube-apiserver-1.29All versions (No fix recorded)
eks-distro-kube-apiserver-1.30All versions (No fix recorded)
eks-distro-kube-apiserver-1.31All versions (No fix recorded)
eks-distro-kube-apiserver-1.32All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.29All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.30All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.31All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.32All versions (No fix recorded)
eks-distro-kube-controller-manager-1.29All versions (No fix recorded)
eks-distro-kube-controller-manager-1.30All versions (No fix recorded)
eks-distro-kube-controller-manager-1.31All versions (No fix recorded)
eks-distro-kube-controller-manager-1.32All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.29All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.30All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.31All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.32All versions (No fix recorded)
external-secrets-fips< 0.9.13-r2
falcoctl< 0.7.3-r2
falcoctl-fips< 0.7.3-r3
flux-kustomize-controller< 1.2.2-r2
flux-kustomize-controller-iamguarded-compat< 1.2.2-r2
flux-source-controller< 1.2.4-r4
flux-source-controller-iamguarded-compat< 1.2.4-r4
flyteAll versions (No fix recorded)
frp< 0.54.0-r2
fulcio< 1.4.4-r2
fulcio-fips< 1.4.4-r2
gitsign< 0.8.1-r3
gitsign-config< 0.8.1-r3
gitsign-credential-cache< 0.8.1-r3
gomplate< 4.0.0-r0
gomplate-fips< 4.0.0-r0
goreleaser< 1.25.0-r0
grpc-health-probe< 0.4.24-r3
grpc-health-probe-compat< 0.4.24-r3
guac< 0.5.1-r1
guaccsub< 0.5.1-r1
guacgql< 0.5.1-r1
guacingest< 0.5.1-r1
guacone< 0.5.1-r1
harbor-2.9-portal-nginx-config< 2.9.5-r17
influxd-2.10All versions (No fix recorded)
influxd-2.7All versions (No fix recorded)
influxd-2.8All versions (No fix recorded)
influxd-2.9All versions (No fix recorded)
influxd-fips-2.10All versions (No fix recorded)
influxd-fips-2.7All versions (No fix recorded)
influxd-fips-2.8All versions (No fix recorded)
influxd-fips-2.9All versions (No fix recorded)
k3s-1.31< 1.31.6.1-r16
k3s-1.32All versions (No fix recorded)
k3s-multicall-1.31< 1.31.6.1-r5
k3s-multicall-1.32< 1.32.9.1-r2
k3s-static-1.31< 1.31.6.1-r16
k3s-static-1.32All versions (No fix recorded)
kargo< 0.4.3-r2
kargo-oci-compat< 0.4.3-r2
kcp-0.29All versions (No fix recorded)
kcp-0.29-cache-serverAll versions (No fix recorded)
kcp-0.29-front-proxyAll versions (No fix recorded)
kcp-0.30All versions (No fix recorded)
kcp-0.30-cache-serverAll versions (No fix recorded)
kcp-0.30-front-proxyAll versions (No fix recorded)
kcp-0.31All versions (No fix recorded)
kcp-0.31-cache-serverAll versions (No fix recorded)
kcp-0.31-front-proxyAll versions (No fix recorded)
kcp-0.32All versions (No fix recorded)
kcp-0.32-cache-serverAll versions (No fix recorded)
kcp-0.32-front-proxyAll versions (No fix recorded)
kcp-fips-0.29All versions (No fix recorded)
kcp-fips-0.29-cache-serverAll versions (No fix recorded)
kcp-fips-0.29-front-proxyAll versions (No fix recorded)
kcp-fips-0.30All versions (No fix recorded)
kcp-fips-0.30-cache-serverAll versions (No fix recorded)
kcp-fips-0.30-front-proxyAll versions (No fix recorded)
kcp-fips-0.31All versions (No fix recorded)
kcp-fips-0.31-cache-serverAll versions (No fix recorded)
kcp-fips-0.31-front-proxyAll versions (No fix recorded)
kcp-fips-0.32All versions (No fix recorded)
kcp-fips-0.32-cache-serverAll versions (No fix recorded)
kcp-fips-0.32-front-proxyAll versions (No fix recorded)
ko< 0.15.2-r3
ko-fips< 0.15.1-r5
kots< 1.128.3-r0 | < 1.108.0-r2
kube-apiserver-1.31All versions (No fix recorded)
kube-apiserver-1.32All versions (No fix recorded)
kube-apiserver-fips-1.31All versions (No fix recorded)
kube-apiserver-fips-1.32All versions (No fix recorded)
kube-conformance-1.32All versions (No fix recorded)
kube-controller-manager-1.31All versions (No fix recorded)
kube-controller-manager-1.32All versions (No fix recorded)
kube-controller-manager-fips-1.31All versions (No fix recorded)
kube-controller-manager-fips-1.32All versions (No fix recorded)
kube-oidc-proxy< 1.0.10-r0
kube-rbac-proxy< 0.18.1-r0
kube-rbac-proxy-fips< 0.18.1-r0
kubeadm-1.31All versions (No fix recorded)
kubeadm-1.32All versions (No fix recorded)
kubeadm-fips-1.31All versions (No fix recorded)
kubeadm-fips-1.32All versions (No fix recorded)
kubectl-1.27All versions (No fix recorded)
kubectl-1.27-defaultAll versions (No fix recorded)
kubectl-1.28All versions (No fix recorded)
kubectl-1.28-defaultAll versions (No fix recorded)
kubectl-1.29All versions (No fix recorded)
kubectl-1.29-defaultAll versions (No fix recorded)
kubectl-bash-completion-1.27All versions (No fix recorded)
kubectl-bash-completion-1.28All versions (No fix recorded)
kubectl-bash-completion-1.29All versions (No fix recorded)
kubernetes-1.30All versions (No fix recorded)
kubernetes-1.31All versions (No fix recorded)
kubernetes-1.32All versions (No fix recorded)
kubernetes-dashboard< 7.5.0-r0
kubernetes-dashboard-fips< 7.9.0-r0
kubernetes-fips-1.31All versions (No fix recorded)
kubernetes-fips-1.32All versions (No fix recorded)
kubescape< 3.0.43-r0 | < 3.0.4-r2
kyverno< 1.11.4-r5
melange< 0.6.9-r2
minio< 0.20240606.093642-r0
minio-fips< 0.20240606.093642-r0
minio-iamguarded-2025-compat< 0.20240606.093642-r0
nerdctl< 1.7.5-r0
neuvector-controller< 5.4.7-r1
neuvector-controller-fips< 5.4.7-r2
oauth2-proxy< 7.6.0-r2
oauth2-proxy-iamguarded-compat< 7.6.0-r2
policy-controller< 0.8.4-r3
policy-controller-fips< 0.8.4-r2
policy-controller-tester< 0.8.4-r3
policy-controller-tester-fips< 0.8.4-r2
rabbitmq-messaging-topology-operator< 1.13.0-r2
rabbitmq-messaging-topology-operator-compat< 1.13.0-r2
rabbitmq-messaging-topology-operator-iamguarded-compat< 1.13.0-r2
rancher-agent-2.10< 2.10.0-r1
rekor< 1.3.5-r2
rekor-backfill-index< 1.3.5-r2
rekor-cli< 1.3.5-r2
rekor-fips< 1.3.5-r2
rekor-fips-backfill-index< 1.3.5-r2
rekor-fips-cli< 1.3.5-r2
rekor-fips-server< 1.3.5-r2
rekor-server< 1.3.5-r2
rke2-runtime-1.31All versions (No fix recorded)
rke2-runtime-1.32All versions (No fix recorded)
rke2-runtime-fips-1.31All versions (No fix recorded)
rke2-runtime-fips-1.32All versions (No fix recorded)
rke2-runtime-fips-kube-apiserver-1.31All versions (No fix recorded)
rke2-runtime-fips-kube-apiserver-1.32All versions (No fix recorded)
rke2-runtime-fips-kube-controller-manager-1.31All versions (No fix recorded)
rke2-runtime-fips-kube-controller-manager-1.32All versions (No fix recorded)
rook< 1.13.6-r1
rook-oci-compat< 1.13.6-r1
sigstore-scaffolding< 0.6.16-r2
sigstore-scaffolding-cloudsqlproxy< 0.6.16-r2
sigstore-scaffolding-ctlog-createctconfig< 0.6.16-r2
sigstore-scaffolding-ctlog-managectroots< 0.6.16-r2
sigstore-scaffolding-ctlog-verifyfulcio< 0.6.16-r2
sigstore-scaffolding-fips< 0.6.16-r2
sigstore-scaffolding-fips-cloudsqlproxy< 0.6.16-r2
sigstore-scaffolding-fips-ctlog-createctconfig< 0.6.16-r2
sigstore-scaffolding-fips-ctlog-managectroots< 0.6.16-r2
sigstore-scaffolding-fips-ctlog-verifyfulcio< 0.6.16-r2
sigstore-scaffolding-fips-fulcio-createcerts< 0.6.16-r2
sigstore-scaffolding-fips-getoidctoken< 0.6.16-r2
sigstore-scaffolding-fips-rekor-createsecret< 0.6.16-r2
sigstore-scaffolding-fips-trillian-createdb< 0.6.16-r2
sigstore-scaffolding-fips-trillian-createtree< 0.6.16-r2
sigstore-scaffolding-fips-trillian-updatetree< 0.6.16-r2
sigstore-scaffolding-fips-tsa-createcertchain< 0.6.16-r2
sigstore-scaffolding-fips-tuf-createsecret< 0.6.16-r2
sigstore-scaffolding-fips-tuf-server< 0.6.16-r2

Show all 199

Alpine1 product

buildah< 1.35.4-r0

2 vendors · 200 products · Showing 200 of 393

References

43 links

github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6gX Refsource CONFIRMARTICLEAdvisoryWEBVendor Advisory
github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298X Refsource MISCFIXWEBPatch
github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28aX Refsource MISCFIXWEBPatch
github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502X Refsource MISCFIXWEBPatch
lists.fedoraproject.org/archives/…WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing ListThird Party Advisory

Show all 43 references

lists.fedoraproject.org/archives/…WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing ListThird Party Advisory
www.suse.com/support/update/announcement/2024/suse-su-20242754-1/Advisory
bugzilla.suse.com/1224123REPORT
www.suse.com/security/cve/CVE-2024-28180WEB
www.suse.com/support/update/announcement/2025/suse-su-20250066-1/Advisory
bugzilla.suse.com/1235211REPORT
access.redhat.com/errata/RHSA-2024:2071Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2268854REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2071.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-28180REPORT
www.cve.org/CVERecord?id=CVE-2024-28180Advisory
nvd.nist.gov/vuln/detail/CVE-2024-28180AdvisoryOval
access.redhat.com/errata/RHSA-2024:2776Advisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2776.jsonAdvisory
access.redhat.com/errata/RHSA-2024:3351Advisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3351.jsonAdvisory
security-tracker.debian.org/tracker/CVE-2024-28180Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28180.jsonAdvisory
github.com/go-jose/go-josePACKAGE
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.opensuse.org/archives/…Advisory
security.alpinelinux.org/vuln/CVE-2024-28180Advisory