A vulnerability in the jose2go library allows unauthenticated remote attackers to trigger a denial of service condition via malicious JWE tokens.

This vulnerability is a resource exhaustion flaw where an attacker can supply a specially crafted JSON Web Encryption token with an exceptionally high compression ratio to the library. The vulnerability is exploitable by an unauthenticated attacker over the network.

The exploitation of this flaw leads to a denial of service, which can render applications relying on the jose2go library unavailable to legitimate users. With a CVSS score of 7.5, this high severity vulnerability poses a significant risk to service continuity and operational uptime for any system processing JWE tokens using the affected versions.

Immediate Action: Update the jose2go dependency to version 1.7.0 or later to incorporate the necessary security fixes.

Proactive Monitoring: Monitor application logs and server resource utilization, specifically CPU and memory consumption, for sudden spikes or crashes associated with request processing.

Compensating Controls: Implement strict input validation or size limits on incoming JWE tokens at the Web Application Firewall or load balancer level to reject payloads with suspicious compression characteristics.

Public Exploit Available: Unknown.

Given the potential for service disruption and the existence of a proof-of-concept, administrators should prioritize updating the jose2go library to version 1.7.0. Ensuring that all dependencies are patched is critical to preventing exploitation and maintaining the resilience of your authentication and encryption workflows.