Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.bitbucket.b_c:jose4j

3 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
0.9.7 (Sep 9, 2026): no advisory affects it
Newest unaffected release
0.9.7 (Sep 9, 2026), the latest release
Advisories
3 · 1 high, 1 medium
Dependents
760
Releases
46 since 0.3.6 (Jun 6, 2014)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token…

    Affected: fixed in 0.9.6.

    Fixed in 0.9.6 (released Mar 6, 2024, 651 days before disclosure).

    The latest release, 0.9.7, is not affected.

  • CVE-2023-51775Medium 6.5

    The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2…

    Affected: fixed in 0.9.4.

    Fixed in 0.9.4 (released Dec 5, 2023, 20 days before disclosure).

    The latest release, 0.9.7, is not affected.

  • jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

    Affected: fixed in 0.9.3.

    Fixed in 0.9.3 (released Feb 8, 2023, 258 days before disclosure).

    The latest release, 0.9.7, is not affected.