VDB
RHSA-2026:60246
RHSA-2026:60246
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le as a component of OpenShift Developer Tools and Services 4.17 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 as a component of OpenShift Developer Tools and Services 4.17 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 as a component of OpenShift Developer Tools and Services 4.17 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 as a component of OpenShift Developer Tools and Services 4.17 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 as a component of OpenShift Developer Tools and Services 4.17 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x as a component of OpenShift Developer Tools and Services 4.17 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x as a component of OpenShift Developer Tools and Services 4.17 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le as a component of OpenShift Developer Tools and Services 4.17 | * |
Timeline
- Aug 26, 2026 CVE Published
- Oct 9, 2026 CVE Updated
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:60246 advisory
- https://access.redhat.com/security/cve/CVE-2024-29371 advisory
- https://access.redhat.com/security/cve/CVE-2025-14813 advisory
- https://access.redhat.com/security/cve/CVE-2025-67030 advisory
- https://access.redhat.com/security/cve/CVE-2026-0636 advisory
- https://access.redhat.com/security/cve/CVE-2026-1605 advisory
- https://access.redhat.com/security/cve/CVE-2026-2332 advisory
- https://access.redhat.com/security/cve/CVE-2026-3505 advisory
- https://access.redhat.com/security/cve/CVE-2026-40542 advisory
- https://access.redhat.com/security/cve/CVE-2026-41409 advisory
- https://access.redhat.com/security/cve/CVE-2026-41635 advisory
- https://access.redhat.com/security/cve/CVE-2026-42778 advisory
- https://access.redhat.com/security/cve/CVE-2026-42779 advisory
- https://access.redhat.com/security/cve/CVE-2026-47065 advisory
- https://access.redhat.com/security/cve/CVE-2026-50193 advisory
- https://access.redhat.com/security/cve/CVE-2026-53435 advisory
- https://access.redhat.com/security/cve/CVE-2026-53437 advisory
- https://access.redhat.com/security/cve/CVE-2026-54399 advisory
- https://access.redhat.com/security/cve/CVE-2026-54428 advisory
- https://access.redhat.com/security/cve/CVE-2026-54512 advisory
…and 147 more