JWX vulnerable to a denial of service attack using compressed JWE message
Priority MEDIUM 63CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0057 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed jwx (lestrrat-go): 2.0.21, 1.2.29github.com/lestrrat-go/jwx/v2 (Go): 2.0.21+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lestrrat-go | jwx | 2.0.0 to before 2.0.21; 1.2.0 to before 1.2.29 | 2.0.21, 1.2.29 | Patch available | CNA |
| — | github.com/lestrrat-go/jwx/v2 (Go) | before 2.0.21 | 2.0.21 | Patch available | GHSA-hj3v-m684-v259 |
| — | github.com/lestrrat-go/jwx (Go) | before 1.2.29 | 1.2.29 | Patch available | GHSA-hj3v-m684-v259 |
- jwx Vendorlestrrat-go Affected 2.0.0 to before 2.0.21; 1.2.0 to before 1.2.29 Fixed in 2.0.21, 1.2.29 Patch available CNA
- github.com/lestrrat-go/jwx/v2 (Go) Vendor— Affected before 2.0.21 Fixed in 2.0.21 Patch available GHSA-hj3v-m684-v259
- github.com/lestrrat-go/jwx (Go) Vendor— Affected before 1.2.29 Fixed in 1.2.29 Patch available GHSA-hj3v-m684-v259
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lestrrat-go:jwx:*:*:*:*:*:*:*:* | before 1.2.29; 2.0.0 to before 2.0.21 | Vulnerable | lestrrat-go |
- cpe:2.3:a:lestrrat-go:jwx:*:*:*:*:*:*:*:* Versions before 1.2.29; 2.0.0 to before 2.0.21 Vulnerable ·lestrrat-go
Remediation
- Fix · CNA jwx (lestrrat-go) Fixed in 2.0.21, 1.2.29
- Fix · GHSA-hj3v-m684-v259 github.com/lestrrat-go/jwx/v2 (Go) Fixed in 2.0.21 Advisory →
- Fix · GHSA-hj3v-m684-v259 github.com/lestrrat-go/jwx (Go) Fixed in 1.2.29 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- OpenShift Service Mesh 2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28122
- 2026-10-03 Alias added: GHSA-hj3v-m684-v259
References
Other 5
- https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29
- https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21
- https://github.com/lestrrat-go/jwx/commit/d01027d74c7376d66037a10f4f64af9af26a7e34
- https://github.com/lestrrat-go/jwx/commit/d43f2ceb7f0c13714dfe8854d6439766e86faa76
- https://github.com/lestrrat-go/jwx
More lestrrat-go Jwx vulnerabilities
- TI-2024-14385 Parsing JSON serialized payload without protected field can lead to segfault CVSS 3.1HIGH 7.5
- TI-2023-26926 Malicious parameters can cause a denial of service in lestrrat-go/jwx CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-28122 · CVE Program
- CVE-2024-28122 · NVD
- FIRST EPSS
- GHSA-hj3v-m684-v259 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-28122 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences