AZL-35842
Record from OSV · Published March 9, 2024
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| influxdb | Azure Linux:2 | 2.6.1-20 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Azure Linux:2 | influxdb | 0 |
Timeline
- Mar 9, 2024 CVE Published
- Apr 21, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln AZL-35842
vulnetix vdb fixes AZL-35842Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/AZL-35842/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart