Vulnerabilities

TI-2024-18702 CVE-2024-28122 · GHSA-hj3v-m684-v259

JWX vulnerable to a denial of service attack using compressed JWE message

MEDIUM 63

JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.0057 Published 2024-03-09 Fixed in 2.0.21, 1.2.29 CWE-400

TI-2024-14385 CVE-2024-21664 · GHSA-pvcr-v8j8-j5q3

HIGH 66

jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00864 Published 2024-01-09 Partial fix · 2.0.19, 1.2.28 CWE-476

TI-2023-26926 CVE-2023-49290 · GHSA-7f9x-gw85-8grf

MEDIUM 63

lestrrat-go/jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00729 Published 2023-12-04 Partial fix · 1.2.27, 2.0.18 CWE-400