Jose Project Jose vulnerabilities
6 known vulnerabilities affecting jose_project/jose.
Total CVEs
6
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH2MEDIUM4
Vulnerabilities
Page 1 of 1
CVE-2026-34240P3HIGH≥ 0, < 0.3.5+12026-03-31
CVE-2026-34240 [HIGH] CWE-347 jose vulnerable to untrusted JWK header key acceptance during signature verification
jose vulnerable to untrusted JWK header key acceptance during signature verification
### Impact
A vulnerability in `jose` versions up to and including `0.3.5` could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (`jwk`).
The vulnerability exists because key selection could treat header-provided `jwk` as a verific
ghsaosv
CVE-2023-50967P3HIGHCVSS 7.5≥ 0, < 10-3+deb11u1≥ 0, < 11-2+deb12u1+1 more2024-03-20
CVE-2023-50967 [HIGH] CVE-2023-50967: latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value
latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
osv
CVE-2024-28176P4MEDIUMCVSS 5.9fixed in 2.0.7≥ 3.0.0, < 4.15.52024-03-09
CVE-2024-28176 [MEDIUM] CWE-400 CVE-2024-28176: jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tok
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has
been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for
ghsanvdosv
CVE-2021-29443P4MEDIUM≥ 1.0.0, < 1.28.1≥ 2.0.0, < 2.0.5+1 more2021-04-19
CVE-2021-29443 [MEDIUM] CWE-203 Padding Oracle Attack due to Observable Timing Discrepancy in jose
Padding Oracle Attack due to Observable Timing Discrepancy in jose
jose is an npm library providing a number of cryptographic operations.
### Impact
[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would b
ghsaosv
CVE-2022-36083P4MEDIUM≥ 1.0.0, < 1.28.2≥ 2.0.0, < 2.0.6+2 more2022-09-16
CVE-2022-36083 [MEDIUM] CWE-400 JOSE vulnerable to resource exhaustion via specifically crafted JWE
JOSE vulnerable to resource exhaustion via specifically crafted JWE
The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` ([PBES2 Count](https://www.rfc-editor.org/rfc/rfc7518.html#section-4.8.1.2)), which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the
ghsaosv
CVE-2023-50966P4MEDIUM≥ 0, < 1.11.72024-03-19
CVE-2023-50966 [MEDIUM] CWE-400 erlang-jose vulnerable to denial of service via large p2c value
erlang-jose vulnerable to denial of service via large p2c value
erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.
ghsaosv