CVE-2025-63811
High · 7.5jose2go is vulnerable to a JWT bomb attack through its decode function
CVSS
7.5
EPSS
0.3%
Published
Nov 12, 2025
CISA due date
—
The record
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high compression ratio.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/dvsekhvalnov/jose2go | 0 | 1.7.0 |
| Chainguard | argo-events | 0 | 1.9.8-r1 |
| Chainguard | argo-events-compat | 0 | 1.9.8-r1 |
| Chainguard | argo-events-fips | 0 | 1.9.8-r1 |
| Chainguard | argo-events-fips-compat | 0 | 1.9.8-r1 |
| Chainguard | bento | 0 | 1.12.1-r2 |
| Chainguard | bento-compat | 0 | 1.12.1-r2 |
| Chainguard | cluster-api-aws-controller | 0 | 2.9.2-r1 |
| Chainguard | cluster-api-aws-controller-compat | 0 | 2.9.2-r1 |
| Chainguard | cluster-api-aws-controller-fips | 0 | 2.9.2-r2 |
| Chainguard | dapr-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-daprd-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-daprd-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-daprd-fips-1.14 | 0 | 1.14.5-r10 |
| Chainguard | dapr-daprd-fips-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-daprd-fips-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-fips-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-injector-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-injector-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-injector-fips-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-injector-fips-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-operator-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-operator-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-operator-fips-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-operator-fips-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-placement-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-placement-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-placement-fips-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-placement-fips-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-scheduler-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-scheduler-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-scheduler-fips-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-scheduler-fips-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-sentry-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-sentry-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | dapr-sentry-fips-1.15 | 0 | 1.15.13-r1 |
| Chainguard | dapr-sentry-fips-1.15-oci-compat | 0 | 1.15.13-r1 |
| Chainguard | grafana-alloy | 0 | 1.11.3-r2 |
| Chainguard | grafana-alloy-compat | 0 | 1.11.3-r2 |
| Chainguard | jitsucom-bulker | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-bulker | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-bulker-compat | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-ingest | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-ingest-compat | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-ingmgr | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-ingmgr-compat | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-sidecar | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-sidecar-compat | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-syncctl | 0 | 2.11.913-r1 |
| Chainguard | jitsucom-bulker-syncctl-compat | 0 | 2.11.913-r1 |
| Chainguard | opentelemetry-collector-contrib | 0 | 0.139.0-r1 |
| Chainguard | opentelemetry-collector-contrib-compat | 0 | 0.139.0-r1 |
| Chainguard | splunk-otel-collector | 0 | 0.139.2-r1 |
| Chainguard | splunk-otel-collector-compat | 0 | 0.139.2-r1 |
| Chainguard | splunk-otel-collector-doc | 0 | 0.139.2-r1 |
| Chainguard | splunk-otel-collector-fips | 0 | 0.139.2-r1 |
| Chainguard | splunk-otel-collector-migratecheckpoint | 0 | 0.139.2-r1 |
| Chainguard | splunk-otel-collector-migratecheckpoint-compat | 0 | 0.139.2-r1 |
| Chainguard | sql_exporter | 0 | 0.18.4-r1 |
| Chainguard | sql_exporter-compat | 0 | 0.18.4-r1 |
| Chainguard | sql_exporter-fips | 0 | 0.18.4-r2 |
| Chainguard | telegraf-1.34 | 0 | 1.34.4-r7 |
| Chainguard | telegraf-1.35 | 0 | 1.35.4-r3 |
| Chainguard | vault-1.16 | 0 | 1.16.3-r27 |
| Chainguard | vault-1.16-compat | 0 | 1.16.3-r27 |
| Chainguard | vault-1.17 | 0 | 1.17.6-r19 |
| Chainguard | vault-1.17-compat | 0 | 1.17.6-r19 |
| Chainguard | vault-1.18-compat | 0 | 1.18.5-r15 |
| Chainguard | vault-1.19-compat | 0 | 1.19.5-r5 |
| Chainguard | vault-1.20-compat | 0 | 1.20.4-r1 |
| Chainguard | vault-1.21 | 0 | 1.21.1-r0 |
| Chainguard | vault-1.21-compat | 0 | 1.21.1-r0 |
| Chainguard | vault-fips-1.19 | 0 | 1.19.5-r9 |
| Chainguard | vault-fips-1.19-compat | 0 | 1.19.5-r9 |
| Chainguard | vault-fips-1.20-compat | 0 | 1.20.4-r1 |
| Chainguard | vault-fips-1.21 | 0 | 1.21.1-r0 |
| Chainguard | vault-fips-1.21-compat | 0 | 1.21.1-r0 |
| Wolfi | argo-events | 0 | 1.9.8-r1 |
| Wolfi | argo-events-compat | 0 | 1.9.8-r1 |
| Wolfi | bento | 0 | 1.12.1-r2 |
| Wolfi | bento-compat | 0 | 1.12.1-r2 |
| Wolfi | cluster-api-aws-controller | 0 | 2.9.2-r1 |
| Wolfi | cluster-api-aws-controller-compat | 0 | 2.9.2-r1 |
| Wolfi | dapr-1.15 | 0 | 1.15.13-r1 |
| Wolfi | dapr-daprd-1.15 | 0 | 1.15.13-r1 |
| Wolfi | dapr-daprd-1.15-oci-compat | 0 | 1.15.13-r1 |
| Wolfi | dapr-injector-1.15 | 0 | 1.15.13-r1 |
| Wolfi | dapr-injector-1.15-oci-compat | 0 | 1.15.13-r1 |
| Wolfi | dapr-operator-1.15 | 0 | 1.15.13-r1 |
| Wolfi | dapr-operator-1.15-oci-compat | 0 | 1.15.13-r1 |
| Wolfi | dapr-placement-1.15 | 0 | 1.15.13-r1 |
| Wolfi | dapr-placement-1.15-oci-compat | 0 | 1.15.13-r1 |
| Wolfi | dapr-scheduler-1.15 | 0 | 1.15.13-r1 |
| Wolfi | dapr-scheduler-1.15-oci-compat | 0 | 1.15.13-r1 |
| Wolfi | dapr-sentry-1.15 | 0 | 1.15.13-r1 |
| Wolfi | dapr-sentry-1.15-oci-compat | 0 | 1.15.13-r1 |
| Wolfi | grafana-alloy | 0 | 1.11.3-r2 |
| Wolfi | grafana-alloy-compat | 0 | 1.11.3-r2 |
| Wolfi | jitsucom-bulker | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-bulker | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-bulker-compat | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-ingest | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-ingest-compat | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-ingmgr | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-ingmgr-compat | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-sidecar | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-sidecar-compat | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-syncctl | 0 | 2.11.913-r1 |
| Wolfi | jitsucom-bulker-syncctl-compat | 0 | 2.11.913-r1 |
| Wolfi | opentelemetry-collector-contrib | 0 | 0.139.0-r1 |
| Wolfi | opentelemetry-collector-contrib-compat | 0 | 0.139.0-r1 |
| Wolfi | splunk-otel-collector | 0 | 0.139.2-r1 |
| Wolfi | splunk-otel-collector-compat | 0 | 0.139.2-r1 |
| Wolfi | splunk-otel-collector-doc | 0 | 0.139.2-r1 |
| Wolfi | splunk-otel-collector-migratecheckpoint | 0 | 0.139.2-r1 |
| Wolfi | splunk-otel-collector-migratecheckpoint-compat | 0 | 0.139.2-r1 |
| Wolfi | sql_exporter | 0 | 0.18.4-r1 |
| Wolfi | sql_exporter-compat | 0 | 0.18.4-r1 |
| Wolfi | telegraf-1.34 | 0 | 1.34.4-r7 |
| Wolfi | telegraf-1.35 | 0 | 1.35.4-r3 |
Related vulnerabilities
- CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. Also affects argo-events
- CVE-2026-33762 go-git is an extensible git implementation library written in pure Go. Also affects argo-events
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects argo-events
- CVE-2026-27142 Actions which insert URLs into the content attribute of HTML meta tags are not escaped. Also affects argo-events
- CVE-2026-27139 On Unix platforms, when listing the contents of a directory using File.ReadDir or… Also affects argo-events
- CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid… Also affects argo-events
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects argo-events
- CVE-2026-25934 go-git is a highly extensible git implementation library written in pure Go. Also affects argo-events