Listen to this Post
The vulnerability in jose4j before version 0.9.5 involves a denial-of-service attack through crafted JSON Web Encryption (JWE) tokens. JWE tokens can use compression algorithms like DEFLATE to reduce size before encryption. An attacker creates a malicious JWE token with an exceptionally high compression ratio, meaning a small compressed payload decompresses to an extremely large output. When a server using jose4j processes this token, it attempts to decompress the content during decryption. The decompression process allocates memory based on the uncompressed size, leading to excessive memory consumption. This occurs because the library trusts the compression ratio without adequate checks. The decompression operation may also cause prolonged processing time due to the large data size. Consequently, the server’s resources are exhausted, resulting in service degradation or crash. This attack exploits the lack of limits on decompression buffer sizes in jose4j. The vulnerability is triggered during the ‘JweDecryption.decrypt()’ method when handling compressed payloads. No authentication bypass is required; any endpoint accepting JWE tokens is vulnerable. The issue stems from insufficient validation of compression ratios in the ‘DeflateCompressionAlgorithm’ implementation. Attackers can repeatedly send such tokens to sustain DoS conditions. Systems using jose4j for JWE processing without compression disabling are at risk. The flaw is specific to the compression feature in JWE, not other JOSE aspects. Patch version 0.9.5 introduces checks to limit decompression memory allocation.
Platform: jose4j
Version: before 0.9.5
Vulnerability: DoS via compression
Severity: High
Date: Dec 17 2025
Prediction: Patch available 0.9.5
What Undercode Say:
Analytics
bash
Check jose4j version in project
mvn dependency:tree | grep jose4j
java -cp “lib/” org.example.CheckVersion jose4j
curl -s https://api.github.com/advisories | grep jose4j
code
// Sample code to test vulnerability
JweDecrypter decrypter = new JweDecrypter(key);
JweToken token = parseMaliciousJWE(); // Crafted high-ratio token
decrypter.decrypt(token); // Triggers excessive memory allocation
How Exploit:
Craft JWE token with high compression ratio using tools like ‘jose’ CLI or custom scripts. Send token to server endpoints accepting JWE. Repeat requests to exhaust memory.
Protection from this CVE
Update to jose4j 0.9.5. Disable JWE compression. Implement rate limiting. Use memory limits.
Impact:
Service downtime, resource exhaustion, potential system crash.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
