| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/go-jose/go-jose/v3 | < 3.0.1 | 3.0.1 |
| github.com/square/go-jose | all versions |
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free