CVE-2025-63811: dvsekhvalnov jose2go Uncontrolled Resource Consumption
CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2025-63811DEBIAN-CVE-2025-63811CGA-2c84-34p7-4w7pCGA-2gg5-8x25-9284CGA-36ww-rqr8-6mfjCGA-379w-g924-m795CGA-3jf2-p5cq-3q58CGA-44vq-268r-f54mCGA-45jc-qh37-xm5qCGA-46f6-rccw-ghchCGA-475f-9676-hr63CGA-4m9w-3q3q-2r6cCGA-565p-rrxj-5hwvCGA-5frh-vfqx-ph24CGA-5q8m-mmwv-rxf7CGA-5vvw-x797-4jjjCGA-6cq7-p287-pjqrCGA-6x59-x727-j9pcCGA-7f9w-3v2x-6pgpCGA-87xf-p95q-mc4qCGA-896j-j46p-gcjhCGA-8jqh-jrp2-w5phCGA-cj5m-f786-mf7qCGA-cpmw-5mp4-q96xCGA-crx6-cjp3-gmvpCGA-f27m-h2r9-79fqCGA-ffpq-g4x5-cphcCGA-fp4f-vx6r-wffcCGA-frjf-rmwc-qfmgCGA-g4cq-2g45-32f6CGA-gcv5-gv5f-xhw2CGA-gvpv-j5gw-2m2fCGA-h52j-p563-jq7cCGA-hj4c-5f2q-c64pCGA-hphp-5269-hv2vCGA-j2wr-mqhm-3fvwCGA-j4jv-jrwr-9px2CGA-jmjr-ch8j-jr2mCGA-mr2f-9cm8-4m4fCGA-p3p5-9r9p-2q26CGA-qgf6-776h-x3pwCGA-r579-h45r-58vwCGA-vhpp-fwmv-gxfmCGA-w3xm-98gf-r463CGA-w884-8m9q-fgrmCGA-wf4f-jp8r-97w8CGA-wg66-6447-9pm7CGA-xj7j-53fp-cm44GHSA-9mj6-hxhv-w67jGO-2025-4123CGA-22h7-2vhx-p7vhCGA-2mvg-rm5g-mw9mCGA-35g8-p5g3-7gxgCGA-36w4-9vxh-7f86CGA-399w-6wrj-c4v8CGA-39mv-3hj8-h46rCGA-3h3p-9849-6jx4CGA-3x7c-rw58-7xp7CGA-3x98-phfq-vr7xCGA-3xc5-jwrm-wrp2CGA-43vv-fgcf-99gxCGA-49c7-7hjw-3hhcCGA-49gg-98j7-8pv4CGA-4g38-3r39-vf54CGA-4j93-hg4w-mjghCGA-4pxg-8jmr-p7j3CGA-58f8-868v-mxp5CGA-58fq-923w-8pp7CGA-5g9w-rx7x-3fvxCGA-5p4x-gjjc-46w3CGA-5r8p-q34h-62m4CGA-5rgr-h8r7-4wg4CGA-5whg-cgwm-g4rxCGA-62w7-c442-47h9CGA-6r73-g9rg-xxg4CGA-78g4-qg5q-6vq7CGA-7gxx-4c84-25h6CGA-7j39-f7mw-m2hxCGA-7j4c-fm7r-r39qCGA-7jcj-5x9v-8mjjCGA-7q8p-j6qv-3cpwCGA-86r7-h4jx-rh68CGA-89wh-rv5v-9qxqCGA-8h77-9h6j-6f84CGA-8px2-m7c2-rp2mCGA-8rg9-h4gr-65g7CGA-92w8-j5wr-cxj6CGA-9cx7-f333-95j2CGA-9qc6-6fjx-j2jxCGA-9wwc-5wgh-75x4CGA-c7q8-j6vc-5xvvCGA-c87c-gcm5-v5jhCGA-cm6f-233g-xvr4CGA-gg7r-fxm3-9hjfCGA-gm89-gw4x-4rf5CGA-gx3c-gwpv-h23hCGA-m48j-gqm8-vjj9CGA-m7q5-r5ch-9v7pCGA-mpcc-79qc-wq6qCGA-p269-ww8m-g396CGA-p622-rffq-8jqqCGA-p9c6-r2gw-wx3jCGA-ppmr-3jgh-9p99CGA-q2w2-g4p2-2jc6CGA-qm37-wmxx-x8wgCGA-qm8v-7mjj-66p9CGA-r6m3-wg62-5gcxCGA-r6qj-82xm-jpj4CGA-r7hh-wmmp-hh25CGA-rvmv-cw74-c6mvCGA-rvvv-3cm6-5f8jCGA-v72g-w3c3-pvwgCGA-vvx4-2f6v-wmx6CGA-w3p2-5hg3-43pxCGA-xgv2-3rch-646gCGA-xhmm-5vx4-m5f2
Published 12-11-2025Last modified 13-11-2025
Vulnerability summary
CVE-2025-63811 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in dvsekhvalnov jose2go. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.26%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 1 · Related 10Timeline
- 12-11-2025PublishedVulnerability first disclosed.
- 13-11-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high compression ratio.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
+0.02 pp
From 0.24% on 19-09-2026
19-09-202619-10-2026
EPSS score0.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundJose2Go
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard57 products
- amazon-cloudwatch-agent< 1.300070.0-r1 | < 1.300073.0-r1
- amazon-cloudwatch-agent-fips< 1.300070.0-r2
- argo-events< 1.9.8-r1
- argo-events-fips< 1.9.8-r1
- bento< 1.12.1-r2
Wolfi22 products
- amazon-cloudwatch-agent< 1.300070.0-r1 | < 1.300073.0-r1
- argo-events< 1.9.8-r1
- bento< 1.12.1-r2
- cluster-api-aws-controller< 2.9.2-r1
- grafana-alloy< 1.11.3-r2
Debian1 product
- golang-github-dvsekhvalnov-jose2goAll versions (No fix recorded) | < 1.9-1
Dvsekhvalnov1 product
- jose2go≥ 1.5.0, < 1.7.0
Github.com/dvsekhvalnov1 product
- jose2go< 1.7.0
Ubuntu1 product
- golang-github-dvsekhvalnov-jose2goAll versions (No fix recorded)
6 vendors · 83 products
