A critical vulnerability in the jose4j library allows unauthenticated remote attackers to cause a Denial-of-Service through memory exhaustion.

The library fails to properly handle JSON Web Encryption (JWE) tokens with high compression ratios. An unauthenticated attacker can submit a crafted token that forces the server to allocate excessive memory and processing time during decompression, leading to a service crash.

This vulnerability carries a CVSS score of 7.5, indicating a high risk to service availability. Successful exploitation allows an attacker to take down critical authentication or data processing services that rely on jose4j, leading to unplanned downtime and potential disruption of business operations.

Immediate Action: Update the jose4j library to version 0.9.6 or later to incorporate the necessary decompression limits.

Proactive Monitoring: Monitor server memory usage and CPU spikes associated with token processing endpoints for signs of abnormal resource consumption.

Compensating Controls: Implement strict input size validation and resource constraints on the application layer to prevent excessively large or highly compressed payloads from reaching the processing engine.

Public Exploit Available: Unknown

Given the potential for service disruption, organizations using jose4j should prioritize upgrading to version 0.9.6 during the next maintenance window. Failure to patch leaves applications vulnerable to simple, unauthenticated resource exhaustion attacks that can render services unavailable to legitimate users.