{"action":"Upgrade github.com/lestrrat-go/jwx to 1.2.29 or later.","affected":[{"fixed":"1.2.29","introduced":"0"}],"component":"github.com/lestrrat-go/jwx","cve_ids":["CVE-2024-28122"],"ecosystem":"Go","epss":0.0057,"exploited":false,"fixed_versions":["1.2.29"],"ghsa_id":"GHSA-hj3v-m684-v259","id":"tcs_01M5KFCMMKKX5QPEPJS7133YG7","modified_at":"2026-09-10T03:50:10.558183196Z","published_at":"2024-03-08T15:06:53Z","references":["https://osv.dev/vulnerability/GHSA-hj3v-m684-v259","https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259","https://nvd.nist.gov/vuln/detail/CVE-2024-28122","https://github.com/lestrrat-go/jwx/commit/d01027d74c7376d66037a10f4f64af9af26a7e34","https://github.com/lestrrat-go/jwx/commit/d43f2ceb7f0c13714dfe8854d6439766e86faa76","https://github.com/lestrrat-go/jwx","https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29","https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-hj3v-m684-v259#Go/github.com/lestrrat-go/jwx","url":"https://osv.dev/vulnerability/GHSA-hj3v-m684-v259"}],"summary":"JWX vulnerable to a denial of service attack using compressed JWE message"}