Cloudanix VulnDB

CVE-2024-29371

High · 7.5

CVSS

7.5

EPSS

0.3%

Published

Dec 17, 2025

CISA due date

—

The record

In jose4j before 0.9.5, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.bitbucket.b_c:jose4j 0 0.9.5
Maven org.bitbucket.b_c:jose4j 0 0.9.6
Chainguard apache-nifi 0 2.7.2-r4
Chainguard apache-nifi-compat 0 2.7.2-r2
Chainguard apache-nifi-toolkit 0 2.7.2-r2
Chainguard apache-pulsar 0 4.1.2-r3
Chainguard apache-pulsar-compat 0 4.1.2-r2
Chainguard confluent-common-docker 0 7.6.9-r0
Chainguard confluent-common-docker 0 7.6.9-r1
Chainguard confluent-common-docker-base 0 7.6.9-r0
Chainguard hadoop-fips-3.3.6 0 3.3.6-r18
Chainguard hadoop-fips-3.3.6 0 3.3.6-r19
Chainguard kafka-3.7 0 3.7.2-r50
Chainguard kafka-3.8 0 3.8.1-r49
Chainguard kafka-3.9 0 3.9.1-r8
Chainguard kafka-4.0 0 4.0.1-r2
Chainguard kafka-4.0 0 4.0.1-r3
Chainguard kafka-iamguarded-compat-4.0 0 4.0.1-r2
Chainguard kafka-strimzi-compat 0 0.49.1-r1
Chainguard kafka_exporter-strimzi-compat 0 0.49.1-r1
Chainguard prometheus-jmx-exporter-strimzi-compat 0 0.49.1-r1
Chainguard strimzi-kafka-operator 0 0.49.1-r1
Chainguard strimzi-kafka-operator-cluster-operator 0 0.49.1-r1
Chainguard strimzi-kafka-operator-kafka-agent 0 0.49.1-r1
Chainguard strimzi-kafka-operator-kafka-agent-3 0 0.49.1-r1
Chainguard strimzi-kafka-operator-kafka-base 0 0.49.1-r1
Chainguard strimzi-kafka-operator-kafka-init 0 0.49.1-r1
Chainguard strimzi-kafka-operator-kafka-thirdparty-libs 0 0.49.1-r1
Chainguard strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.49.1-r1
Chainguard strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.49.1-r5
Chainguard strimzi-kafka-operator-mirror-maker-agent 0 0.49.1-r1
Chainguard strimzi-kafka-operator-topic-operator 0 0.49.1-r1
Chainguard strimzi-kafka-operator-tracing-agent 0 0.49.1-r1
Chainguard strimzi-kafka-operator-user-operator 0 0.49.1-r1
Wolfi apache-nifi 0 2.7.2-r4
Wolfi apache-nifi-compat 0 2.7.2-r2
Wolfi apache-nifi-toolkit 0 2.7.2-r2
Wolfi apache-pulsar 0 4.1.2-r3
Wolfi apache-pulsar-compat 0 4.1.2-r2
Wolfi confluent-common-docker 0 7.6.9-r0
Wolfi confluent-common-docker 0 7.6.9-r1
Wolfi confluent-common-docker-base 0 7.6.9-r0
Wolfi kafka-3.8 0 3.8.1-r49
Wolfi kafka-3.9 0 3.9.1-r8
Wolfi kafka-4.0 0 4.0.1-r3
Wolfi kafka-iamguarded-compat-4.0 0 4.0.1-r2
Wolfi kafka-strimzi-compat 0 0.49.1-r1
Wolfi kafka_exporter-strimzi-compat 0 0.49.1-r1
Wolfi prometheus-jmx-exporter-strimzi-compat 0 0.49.1-r1
Wolfi strimzi-kafka-operator 0 0.49.1-r1
Wolfi strimzi-kafka-operator-cluster-operator 0 0.49.1-r1
Wolfi strimzi-kafka-operator-kafka-agent 0 0.49.1-r1
Wolfi strimzi-kafka-operator-kafka-agent-3 0 0.49.1-r1
Wolfi strimzi-kafka-operator-kafka-base 0 0.49.1-r1
Wolfi strimzi-kafka-operator-kafka-init 0 0.49.1-r1
Wolfi strimzi-kafka-operator-kafka-thirdparty-libs 0 0.49.1-r1
Wolfi strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.49.1-r1
Wolfi strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.49.1-r5
Wolfi strimzi-kafka-operator-mirror-maker-agent 0 0.49.1-r1
Wolfi strimzi-kafka-operator-topic-operator 0 0.49.1-r1
Wolfi strimzi-kafka-operator-tracing-agent 0 0.49.1-r1
Wolfi strimzi-kafka-operator-user-operator 0 0.49.1-r1

Related vulnerabilities