Vendors / Jose4j Project Records 3 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 2
Exploited now Jose4j Project records in CISA KEV No Jose4j Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 72
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00257 · Published 2025-12-17 · Partial fix · 0.9.6 CWE-1259
Priority MEDIUM 62
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00871 · Published 2023-12-25 · Partial fix · 0.9.4 CWE-400
Priority MEDIUM 40
jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00766 · Published 2023-10-24 · Partial fix · 0.9.3 CWE-331
Open these records in search → All records by CVSS severity
0 2 1 0 0
