Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Priority LOW 26CWE-409Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 24 fixed, 24 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01956 80th percentileScored 2026-11-07
Fix Partial go-jose (go-jose): 4.0.1, 3.0.3, 2.6.3github.com/go-jose/go-jose/v4 (Go): 4.0.1+2 more productsRed Hat: 50 advisoriesRed Hat: 24 fixed, 24 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-jose | go-jose | before 4.0.1; before 3.0.3; before 2.6.3 | 4.0.1, 3.0.3, 2.6.3 | Patch available | CNA |
| — | github.com/go-jose/go-jose/v4 (Go) | before 4.0.1 | 4.0.1 | Patch available | GHSA-c5q2-7r4c-mv6g |
| — | github.com/go-jose/go-jose/v3 (Go) | before 3.0.3 | 3.0.3 | Patch available | GHSA-c5q2-7r4c-mv6g |
| — | gopkg.in/go-jose/go-jose.v2 (Go) | before 2.6.3 | 2.6.3 | Patch available | GHSA-c5q2-7r4c-mv6g |
| — | gopkg.in/square/go-jose.v2 (Go) | up to 2.6.0 | — | No fix listed | GHSA-c5q2-7r4c-mv6g |
- go-jose Vendorgo-jose Affected before 4.0.1; before 3.0.3; before 2.6.3 Fixed in 4.0.1, 3.0.3, 2.6.3 Patch available CNA
- github.com/go-jose/go-jose/v4 (Go) Vendor— Affected before 4.0.1 Fixed in 4.0.1 Patch available GHSA-c5q2-7r4c-mv6g
- github.com/go-jose/go-jose/v3 (Go) Vendor— Affected before 3.0.3 Fixed in 3.0.3 Patch available GHSA-c5q2-7r4c-mv6g
- gopkg.in/go-jose/go-jose.v2 (Go) Vendor— Affected before 2.6.3 Fixed in 2.6.3 Patch available GHSA-c5q2-7r4c-mv6g
- gopkg.in/square/go-jose.v2 (Go) Vendor— Affected up to 2.6.0 Fixed in — No fix listed GHSA-c5q2-7r4c-mv6g
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:* | 2.0.0 to before 2.6.3; 3.0.0 to before 3.0.3; 4.0.0 to before 4.0.1 | Vulnerable | Go-jose Project |
| cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:* | 38 – 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.3; 3.0.0 to before 3.0.3; 4.0.0 to before 4.0.1 Vulnerable ·Go-jose Project
- cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:* Versions 38 – 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA go-jose (go-jose) Fixed in 4.0.1, 3.0.3, 2.6.3
- Fix · GHSA-c5q2-7r4c-mv6g github.com/go-jose/go-jose/v4 (Go) Fixed in 4.0.1 Advisory →
- Fix · GHSA-c5q2-7r4c-mv6g github.com/go-jose/go-jose/v3 (Go) Fixed in 3.0.3 Advisory →
- Fix · GHSA-c5q2-7r4c-mv6g gopkg.in/go-jose/go-jose.v2 (Go) Fixed in 2.6.3 Advisory →
Red Hat 50 advisories
- RHSA-2025:0536 Released 2025-01-21 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.15.0
- cert-manager operator for Red Hat OpenShift 1.15 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2024:8974 Released 2024-11-06 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.12.0 security and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/acm-cli-rhel9, rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9 +43
- RHSA-2024:8425 Released 2024-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.15.37 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
Show 47 more Red Hat advisories
- RHSA-2024:8260 Released 2024-10-24 · Red Hat rating ImportantOpenShift Container Platform 4.16.18 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:8235 Released 2024-10-23 · Red Hat rating ImportantOpenShift Container Platform 4.14.39 security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-cluster-baremetal-operator-rhel8, openshift4/ose-ibm-cloud-controller-manager-rhel8 +5
- RHSA-2024:8229 Released 2024-10-23 · Red Hat rating ImportantOpenShift Container Platform 4.17.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:7179 Released 2024-10-02 · Red Hat rating ModerateOpenShift Container Platform 4.15.35 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-openshift-controller-manager-rhel9
- RHSA-2024:3718 Released 2024-10-01 · Red Hat rating ModerateOpenShift Container Platform 4.17.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:7164 Released 2024-09-26 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.4 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8
- RHSA-2024:6687 Released 2024-09-19 · Red Hat rating ImportantOpenShift Container Platform 4.16.13 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/ose-docker-builder-rhel9, openshift4/ose-openshift-controller-manager-rhel9
- RHSA-2024:6209 Released 2024-09-03 · Red Hat rating ModerateRed Hat OpenShift Service Mesh Containers for 2.4.10 security update
- RHOSSM 2.4 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +4
- RHSA-2024:4591 Released 2024-07-17 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +8
- RHSA-2024:4484 Released 2024-07-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.45 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-olm-rukpak-rhel8, openshift4/ose-operator-lifecycle-manager +4
- RHSA-2024:4455 Released 2024-07-10 · Red Hat rating ModerateOpenShift Virtualization 4.16.0 Images security update
- CNV 4.16 for RHEL 9 container-native-virtualization/kubevirt-console-plugin-rhel9, container-native-virtualization/kubevirt-ssp-operator-rhel9, container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9 +1
- RHSA-2024:0041 Released 2024-06-27 · Red Hat rating CriticalOpenShift Container Platform 4.16.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:4006 Released 2024-06-27 · Red Hat rating ImportantOpenShift Container Platform 4.12.60 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-cluster-autoscaler-operator, openshift4/ose-console, openshift4/ose-machine-api-operator +2
- RHSA-2024:4041 Released 2024-06-26 · Red Hat rating ImportantOpenShift Container Platform 4.15.19 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-docker-builder, openshift4/ose-operator-lifecycle-manager-rhel9, openshift4/ose-operator-registry-rhel9 +1
- RHSA-2024:4010 Released 2024-06-26 · Red Hat rating ImportantOpenShift Container Platform 4.14.31 security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-olm-rukpak-rhel8, openshift4/ose-operator-lifecycle-manager +4
- RHSA-2024:4028 Released 2024-06-20 · Red Hat rating ModerateRelease of OpenShift Serverless 1.33.0 security update & enhancements
- Red Hat OpenShift Serverless 1.33 openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1/client-kn-rhel8 +33
- RHSA-2024:3968 Released 2024-06-18 · Red Hat rating Moderatecontainer-tools:rhel8 bug fix and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21962+8143777b.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21962+8143777b.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21962+8143777b.s390x::container-tools:rhel8 +47
- RHSA-2024:3827 Released 2024-06-11 · Red Hat rating Moderatebuildah security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.33.7-2.el9_4, buildah-tests-2:1.33.7-2.el9_4
- RHSA-2024:3826 Released 2024-06-11 · Red Hat rating Moderatepodman security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-4.el9_4, podman-docker-4:4.9.4-4.el9_4, podman-plugins-4:4.9.4-4.el9_4 +2
- RHSA-2024:3523 Released 2024-06-10 · Red Hat rating ImportantOpenShift Container Platform 4.14.28 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-operator-registry, openshift4/ose-powervs-block-csi-driver-rhel8
- RHSA-2024:3351 Released 2024-05-30 · Red Hat rating ModerateOpenShift Container Platform 4.12.58 security update
- Red Hat OpenShift Container Platform 4.12 cri-o-1.25.5-19.2.rhaos4.12.gitba93e0a.el8, podman-3:4.4.1-4.2.rhaos4.12.el8, podman-catatonit-3:4.4.1-4.2.rhaos4.12.el8 +5
- RHSA-2024:3349 Released 2024-05-30 · Red Hat rating ModerateOpenShift Container Platform 4.12.58 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-aws-pod-identity-webhook-rhel8, openshift4/ose-cloud-credential-operator
- RHSA-2024:3327 Released 2024-05-29 · Red Hat rating ImportantOpenShift Container Platform 4.15.15 security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-ironic-rhel9, openshift4/ose-powervs-block-csi-driver-rhel9, openshift4/ose-telemeter-rhel9
- RHSA-2024:2877 Released 2024-05-23 · Red Hat rating ImportantOpenShift Container Platform 4.13.42 packages and security update
- Red Hat OpenShift Container Platform 4.13 cri-o-1.26.5-15.2.rhaos4.13.gitb742e63.el8, cri-o-1.26.5-15.2.rhaos4.13.gitb742e63.el9, podman-3:4.4.1-7.3.rhaos4.13.el8 +12
- RHSA-2024:2875 Released 2024-05-23 · Red Hat rating ImportantOpenShift Container Platform 4.13.42 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-aws-pod-identity-webhook-rhel8, openshift4/ose-cloud-credential-operator, openshift4/ose-cluster-etcd-rhel8-operator +3
- RHSA-2024:2869 Released 2024-05-23 · Red Hat rating ModerateOpenShift Container Platform 4.14.26 security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-pod-identity-webhook-rhel8, openshift4/ose-azure-workload-identity-webhook-rhel8, openshift4/ose-cloud-credential-operator
- RHSA-2024:3254 Released 2024-05-22 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2024:2865 Released 2024-05-21 · Red Hat rating ImportantOpenShift Container Platform 4.15.14 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-aws-pod-identity-webhook-rhel9, openshift4/ose-azure-cloud-node-manager-rhel9, openshift4/ose-azure-cluster-api-controllers-rhel9 +3
- RHSA-2024:2784 Released 2024-05-16 · Red Hat rating ImportantOpenShift Container Platform 4.12.57 security update
- Red Hat OpenShift Container Platform 4.12 cri-o-1.25.5-16.2.rhaos4.12.gitcb09013.el8, podman-3:4.4.1-3.2.rhaos4.12.el8, podman-catatonit-3:4.4.1-3.2.rhaos4.12.el8 +9
- RHSA-2024:2776 Released 2024-05-15 · Red Hat rating ModerateOpenShift Container Platform 4.15.13 packages and security update
- Red Hat OpenShift Container Platform 4.15 openshift-clients-4.15.0-202405021207.p0.g7693229.assembly.stream.el8, openshift-clients-4.15.0-202405021207.p0.g7693229.assembly.stream.el9, openshift-clients-redistributable-4.15.0-202405021207.p0.g7693229.assembly.stream.el8 +1
- RHSA-2024:2773 Released 2024-05-15 · Red Hat rating ImportantOpenShift Container Platform 4.15.13 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-azure-workload-identity-webhook-rhel8, openshift4/ose-cluster-api-rhel9 +3
- RHSA-2024:2672 Released 2024-05-09 · Red Hat rating ImportantOpenShift Container Platform 4.14.24 packages and security update
- Red Hat OpenShift Container Platform 4.14 cri-o-1.27.6-2.rhaos4.14.gitb3bd0bf.el8, cri-o-1.27.6-2.rhaos4.14.gitb3bd0bf.el9, openshift-4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8 +16
- RHSA-2024:2669 Released 2024-05-09 · Red Hat rating ImportantOpenShift Container Platform 4.15.12 security update
- Red Hat OpenShift Container Platform 4.15 cri-o-1.28.6-2.rhaos4.15.git77bbb1c.el8, cri-o-1.28.6-2.rhaos4.15.git77bbb1c.el9, podman-3:4.4.1-23.2.rhaos4.15.el8 +12
- RHSA-2024:2049 Released 2024-05-02 · Red Hat rating ImportantOpenShift Container Platform 4.13.41 packages and security update
- Red Hat OpenShift Container Platform 4.13 openshift-4.13.0-202404222036.p0.g4818370.assembly.stream.el8, openshift-4.13.0-202404222036.p0.g4818370.assembly.stream.el9, openshift-hyperkube-4.13.0-202404222036.p0.g4818370.assembly.stream.el8 +18
- RHSA-2024:2054 Released 2024-05-02 · Red Hat rating ModerateOpenShift Container Platform 4.14.23 security update
- Red Hat OpenShift Container Platform 4.14 openshift-4.14.0-202404231437.p0.g401bb48.assembly.stream.el8, openshift-4.14.0-202404231437.p0.g401bb48.assembly.stream.el9, openshift-hyperkube-4.14.0-202404231437.p0.g401bb48.assembly.stream.el8 +5
- RHSA-2024:2071 Released 2024-05-02 · Red Hat rating ModerateOpenShift Container Platform 4.15.11 packages and security update
- Red Hat OpenShift Container Platform 4.15 skopeo-2:1.11.3-0.1.rhaos4.15.el8, skopeo-2:1.11.3-0.1.rhaos4.15.el9, skopeo-tests-2:1.11.3-0.1.rhaos4.15.el8 +1
- RHSA-2024:2096 Released 2024-05-01 · Red Hat rating Moderatesecurity update Logging for Red Hat OpenShift - 5.9.1
- RHOL 5.9 for RHEL 9 openshift-logging/logging-loki-rhel9, openshift-logging/lokistack-gateway-rhel9
- RHSA-2024:2639 Released 2024-05-01 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.15 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8, rhmtc/openshift-velero-plugin-rhel8
- RHSA-2024:2549 Released 2024-04-30 · Red Hat rating Moderateskopeo security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.14.3-2.el9_4, skopeo-tests-2:1.14.3-2.el9_4
- RHSA-2024:1946 Released 2024-04-22 · Red Hat rating ModerateRed Hat OpenShift Service Mesh Containers for 2.5.1 security update
- RHOSSM 2.5 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +7
- RHSA-2024:1859 Released 2024-04-16 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.3.1 security and bug fix update
- 9Base-OADP-1.3 oadp/oadp-rhel9-operator, oadp/oadp-velero-plugin-for-csi-rhel9, oadp/oadp-velero-plugin-for-gcp-rhel9 +3
- RHSA-2024:1812 Released 2024-04-15 · Red Hat rating ModerateCustom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-376 Bug Fixes
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle +2
- RHSA-2024:1567 Released 2024-04-03 · Red Hat rating ImportantOpenShift Container Platform 4.14.19 security update
- Red Hat OpenShift Container Platform 4.14 butane-0.19.0-1.3.rhaos4.14.el8, butane-redistributable-0.19.0-1.3.rhaos4.14.el8, containernetworking-plugins-1:1.4.0-1.2.rhaos4.14.el8 +29
- RHSA-2024:1574 Released 2024-04-03 · Red Hat rating ImportantOpenShift Container Platform 4.12.54 packages and security update
- Red Hat OpenShift Container Platform 4.12 buildah-1:1.23.4-5.2.rhaos4.12.el8, buildah-1:1.23.4-5.2.rhaos4.12.el9, buildah-tests-1:1.23.4-5.2.rhaos4.12.el8 +35
- RHSA-2024:1563 Released 2024-04-02 · Red Hat rating ImportantOpenShift Container Platform 4.15.6 packages and security update
- Red Hat OpenShift Container Platform 4.15 buildah-1:1.29.1-20.3.rhaos4.15.el8, buildah-1:1.29.1-20.3.rhaos4.15.el9, buildah-tests-1:1.29.1-20.3.rhaos4.15.el8 +35
- RHSA-2024:1570 Released 2024-03-28 · Red Hat rating ImportantACS 4.4 enhancement and security update
- RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
- RHSA-2024:1456 Released 2024-03-27 · Red Hat rating ModerateOpenShift Container Platform 4.13.38 packages and security update
- Red Hat OpenShift Container Platform 4.13 cri-o-1.26.5-10.rhaos4.13.gita08b329.el8, cri-o-1.26.5-10.rhaos4.13.gita08b329.el9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| OpenShift API for Data Protection | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2024:2639 |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:7164 |
| 9Base-OADP-1.3 | Fixed | RHSA-2024:1859 |
| CNV 4.16 for RHEL 9 | Fixed | RHSA-2024:4455 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2024:1812 |
| OpenShift Pipelines version 1.15 for RHEL 8 | Fixed | — |
| RHACS 4.4 for RHEL 8 | Fixed | RHSA-2024:1570 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2024:4591 |
| RHOL 5.9 for RHEL 9 | Fixed | RHSA-2024:2096 |
| RHOSSM 2.4 for RHEL 8 | Fixed | RHSA-2024:6209 |
| RHOSSM 2.5 for RHEL 8 | Fixed | RHSA-2024:1946 |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | Fixed | RHSA-2024:8974 |
| Red Hat Ceph Storage 5.3 Tools | Fixed | — |
| Red Hat Ceph Storage 7.1 Tools | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:3254, RHSA-2024:3968 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2549, RHSA-2024:3826, RHSA-2024:3827 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:1574, RHSA-2024:2784, RHSA-2024:3349, RHSA-2024:3351, RHSA-2024:4006 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:1456, RHSA-2024:2049, RHSA-2024:2875, RHSA-2024:2877, RHSA-2024:4484 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:1567, RHSA-2024:2054, RHSA-2024:2672, RHSA-2024:2869, RHSA-2024:3523, RHSA-2024:4010, RHSA-2024:8235 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:1563, RHSA-2024:2071, RHSA-2024:2669, RHSA-2024:2773, RHSA-2024:2776, RHSA-2024:2865, RHSA-2024:3327, RHSA-2024:4041, RHSA-2024:7179, RHSA-2024:8425 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:0041, RHSA-2024:6687, RHSA-2024:8260 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:3718, RHSA-2024:8229 |
| Red Hat OpenShift Serverless 1.33 | Fixed | RHSA-2024:4028 |
| cert-manager operator for Red Hat OpenShift 1.15 | Fixed | RHSA-2025:0536 |
Not affected: 25 products
- 8Base-RHMTC-1.7
- 8Base-RHMTC-1.8
- 9Base-OADP-1.3
- CNV 4.16 for RHEL 9
- Ironic content for Red Hat OpenShift Container Platform 4.15
- Multicluster Engine for Kubernetes
- OpenShift API for Data Protection
- OpenShift Serverless
- RHACS 4.4 for RHEL 8
- RHODF 4.16 for RHEL 9
- RHOL 5.9 for RHEL 9
- Red Hat Developer Hub 1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Virtualization 4
- Red Hat Openshift Data Foundation 4
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28180
- 2026-10-03 Alias added: GHSA-c5q2-7r4c-mv6g
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: Red Hat Ceph Storage 5.3 Tools · Red Hat
References
Patch 3
Advisory 11
- https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/
- https://nvd.nist.gov/vuln/detail/CVE-2024-28180
Other 10
- https://github.com/go-jose/go-jose
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH
More go-jose vulnerabilities
- TI-2026-80925 Denial of service in go-jose when parsing JWKs with RSA keys CVSS 3.1HIGH 7.5
- TI-2026-80924 Go JOSE: Panics in JSON parsing CVSS 4.0MEDIUM 6.9
- TI-2026-80923 Panic in Go JOSE CBC-HMAC decryption enables denial of service CVSS 4.0MEDIUM 6.9
- TI-2025-20001 Go JOSE's Parsing Vulnerable to Denial of Service CVSS 4.0MEDIUM 6.6
Sources
- CVE-2024-28180 · CVE Program
- CVE-2024-28180 · NVD
- FIRST EPSS
- GHSA-c5q2-7r4c-mv6g · GitHub Advisory Database · CC BY 4.0
- CVE-2024-28180 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences