{"schemaVersion":3,"id":"GHSA-8G9C-28FC-MCX2","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Duplicate Advisory: Microsoft Identity Denial of service vulnerability\n\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-59j7-ghrg-fj52. This link is maintained to preserve external references.\n\n### Original Description\n\n### Impact\nAn attacker could exploit this vulnerability by crafting a malicious JSON Web Encryption (JWE) token with a high compression ratio. This token, when processed by a server, leads to excessive memory allocation and processing time during decompression, causing a denial-of-service (DoS) condition.\n\nIt's important to note that the attacker must have access to the public encrypt key registered with the IDP(Entra ID) for successful exploitation.\n\n_According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?_\nA scope change (S:C) in the CVSS metric indicates that successful exploitation of this vulnerability could extend beyond the immediate processing of malicious tokens, affecting the overall availability of the system by causing a denial-of-service (DoS) condition.\n\n### Patches\nThe vulnerability has been fixed. Users should update **all** their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher, and 5.7.0 (for 5x).\n\n### Workarounds\nNo, users must upgrade.\n\n### References\nhttps://aka.ms/IdentityModel/Jan2024/zip","dates":{"published":"2024-01-09T18:28:03.000Z","modified":"2026-09-10T03:50:10.909Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"OSV · Nuget","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","computed":true,"selection":"version-preference"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Nuget","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","exploitability":5.9,"impact":6.7,"computed":true}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"NuGet","product":"Microsoft.IdentityModel.JsonWebTokens","name":"Microsoft.IdentityModel.JsonWebTokens","label":"Microsoft.IdentityModel.JsonWebTokens","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.IdentityModel.JsonWebTokens","purlType":"nuget","versions":[{"text":"< 5.7.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, < 6.34.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0-preview, < 7.1.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.7.0 | ≥ 6.5.0, < 6.34.0 | ≥ 7.0.0-preview, < 7.1.2","eol":null,"hubHref":null},{"vendor":"NuGet","product":"System.IdentityModel.Tokens.Jwt","name":"System.IdentityModel.Tokens.Jwt","label":"System.IdentityModel.Tokens.Jwt","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/System.IdentityModel.Tokens.Jwt","purlType":"nuget","versions":[{"text":"< 5.7.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, < 6.34.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0-preview, < 7.1.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.7.0 | ≥ 6.5.0, < 6.34.0 | ≥ 7.0.0-preview, < 7.1.2","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","label":"github.com/AzureAD/…","hostname":"github.com","tags":["WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","label":"nvd.nist.gov/vuln/detail/CVE-2024-21319","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet","label":"github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/5.7.0","label":"github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/5.7.0","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0","label":"github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2","label":"github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2","hostname":"github.com","tags":["WEB"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319","label":"msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319","hostname":"msrc.microsoft.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-2GP4-GG7P-672J"]},"timeline":[{"kind":"published","date":"2024-01-09T18:28:03.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-10T03:50:10.909Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":27,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T00:19:23.114Z","stale":false,"partial":false}}