CVE-2024-29371
CVE-2024-29371 is a high-severity vulnerability in Jose4j Project Jose4j with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1259.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- EPSS exploit prediction: 0% (15th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-26381
- Weakness: CWE-1259
- Affected product: Jose4j Project Jose4j
- Published:
- Last modified:
Description
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Frequently asked questions
- What is CVE-2024-29371?
- In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
- How severe is CVE-2024-29371?
- CVE-2024-29371 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2024-29371 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-29371?
- CVE-2024-29371 affects Jose4j Project Jose4j. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-29371?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-29371 have an EU (EUVD) identifier?
- Yes. CVE-2024-29371 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-26381.
- When was CVE-2024-29371 published?
- CVE-2024-29371 was published on 2025-12-17 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:jose4j_project:jose4j:*:*:*:*:*:*:*:*
More vulnerabilities in Jose4j Project Jose4j
- CVE-2023-31582 — High (CVSS 7.5): jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.
- CVE-2023-51775 — Medium (CVSS 6.5): The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large…
All CVEs affecting Jose4j Project Jose4j →
Other CWE-1259 vulnerabilities
- CVE-2024-36533 — Critical (CVSS 9.8): Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining…
- CVE-2026-25700 — High (CVSS 7.2): Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer:…
- CVE-2025-56207 — Medium (CVSS 6.5): A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an…
- CVE-2024-4598 — Medium (CVSS 6.5): An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich…
- CVE-2025-51306 — Medium (CVSS 6.5): In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the…
- CVE-2025-27955 — Medium (CVSS 6.5): Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout…