Vulnerability · Published Dec 17, 2025 · Assigned by mitre
CVE-2024-29371
High 7.5
In plain English
A high-severity security flaw in the libjose4j-java package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 82.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | libjose4j-java | 0.9.6-1 | DEBIAN-CVE-2024-29371 |
| Debian:14 | libjose4j-java | 0.9.6-1 | DEBIAN-CVE-2024-29371 |
| Maven | org.bitbucket.b_c:jose4j | 0.9.6 | GHSA-3677-xxcr-wjqv |
| Ubuntu:22.04:LTS | libjose4j-java | no fix listed | UBUNTU-CVE-2024-29371 |
| Ubuntu:24.04:LTS | libjose4j-java | no fix listed | UBUNTU-CVE-2024-29371 |
| Ubuntu:25.10 | libjose4j-java | no fix listed | UBUNTU-CVE-2024-29371 |
| Ubuntu:26.04:LTS | libjose4j-java | no fix listed | UBUNTU-CVE-2024-29371 |
| Ubuntu:26.10 | libjose4j-java | no fix listed | UBUNTU-CVE-2024-29371 |
Affected products (as reported)
Weakness: CWE-1259 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H