Read the docs
TI-2024-19434 Aliases CVE-2024-29371GHSA-3677-xxcr-wjqv

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by…

Priority HIGH 72CWE-1259Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 16 fixed, 11 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.bitbucket.b_c:jose4j (Maven): 0.9.6Red Hat: 28 advisoriesRed Hat: 16 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.bitbucket.b_c:jose4j (Maven)before 0.9.60.9.6Patch availableGHSA-3677-xxcr-wjqv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.bitbucket.b_c:jose4j (Maven) Vendor— Affected before 0.9.6 Fixed in 0.9.6 Patch available GHSA-3677-xxcr-wjqv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jose4j_project:jose4j:*:*:*:*:*:*:*:*before 0.9.5VulnerableJose4j Project
  • cpe:2.3:a:jose4j_project:jose4j:*:*:*:*:*:*:*:* Versions before 0.9.5 Vulnerable ·Jose4j Project

Remediation

  • Fix · GHSA-3677-xxcr-wjqv org.bitbucket.b_c:jose4j (Maven) Fixed in 0.9.6 Advisory →

Red Hat 28 advisories

  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 25 more Red Hat advisories
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
  • RHSA-2026:33371 Released 2026-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.18 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services-3.4.10-4.SP2_redhat_00004.1.el7eap +7
  • RHSA-2026:13571 Released 2026-05-04 · Red Hat rating Critical
    Streams for Apache Kafka 3.2.0 release and security update
    • Streams for Apache Kafka 3.2.0
  • RHSA-2026:10214 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:10215 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:10213 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:10211 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:10209 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:10206 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:10205 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:10204 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:10201 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:10199 Released 2026-04-23 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2025:17299 Released 2025-10-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.0 io.netty.netty-codec-4.1.127.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.127.Final-redhat-00001.jar, org.apache.cxf.cxf-rt-transports-jms-4.0.9.redhat-00002.jar +1
  • RHSA-2024:5479 Released 2024-08-15 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.3 Security update
    • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-activemq-artemis-2.21.0-5.redhat_00052.1.el8eap, eap8-activemq-artemis-cli-2.21.0-5.redhat_00052.1.el8eap, eap8-activemq-artemis-commons-2.21.0-5.redhat_00052.1.el8eap +47
  • RHSA-2024:5481 Released 2024-08-15 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.3 Security update
    • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-activemq-artemis-2.21.0-5.redhat_00052.1.el9eap, eap8-activemq-artemis-cli-2.21.0-5.redhat_00052.1.el9eap, eap8-activemq-artemis-commons-2.21.0-5.redhat_00052.1.el9eap +47
  • RHSA-2024:5482 Released 2024-08-15 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.3 Security update
    • Red Hat JBoss Enterprise Application Platform 8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:10209, RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:10201, RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:10211, RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:10204, RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:10214, RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:10213, RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:10215, RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:10206, RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:10205, RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:10199, RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:33371
Red Hat JBoss Enterprise Application Platform 8Fixed RHSA-2024:5482
Red Hat JBoss Enterprise Application Platform 8.1.0Fixed RHSA-2025:17299
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
Streams for Apache Kafka 3.2.0Fixed RHSA-2026:13571
Not affected: 19 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • Red Hat JBoss Enterprise Application Platform 8.1.0
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29371
  2. 2026-10-03 Alias added: GHSA-3677-xxcr-wjqv
  3. 2026-10-10 Affected versions changed · Red Hat
  4. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.0 · Red Hat

References

Exploit 1

Advisory 1

Other 2

  • TI-2023-28403 The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service… CVSS 3.1MEDIUM 6.5
  • TI-2023-15127 jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences