CVE-2024-29371
No sign of exploitation. No public exploitation artifact known so far.
jose4j library before version 0.9.6 is vulnerable to a denial-of-service attack when processing specially crafted encrypted tokens that use extreme compression. An attacker can send these malicious tokens to make the server consume excessive memory and CPU, potentially crashing it or making it unresponsive.
CVE-2024-29371 exploits insufficient resource validation during JWE decompression in jose4j <0.9.6. An attacker crafts a JWE token with an exceptionally high compression ratio; when the server decompresses it, the algorithm expands to consume massive memory and processing time, triggering DoS. No authentication is required if the application processes untrusted JWE tokens.