Go/github.com/lestrrat-go/jwx/v2 CVE-2024-28122: medium 6.8, EPSS 0.57%

JWX vulnerable to a denial of service attack using compressed JWE message

Action: Upgrade github.com/lestrrat-go/jwx/v2 to 2.0.21 or later.

go get github.com/lestrrat-go/jwx/v2@v2.0.21

Affected

Fixed versions

Sources

• osv: GHSA-hj3v-m684-v259
• https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259
• https://nvd.nist.gov/vuln/detail/CVE-2024-28122
• https://github.com/lestrrat-go/jwx/commit/d01027d74c7376d66037a10f4f64af9af26a7e34
• https://github.com/lestrrat-go/jwx/commit/d43f2ceb7f0c13714dfe8854d6439766e86faa76
• https://github.com/lestrrat-go/jwx
• https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29
• https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21

CVE-2024-28122 · published 2024-03-08T15:06:53Z · modified 2026-09-10T03:50:10.558183196Z · JSON