VDB
RHSA-2026:60251
RHSA-2026:60251
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le as a component of OpenShift Developer Tools and Services 4.16 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 as a component of OpenShift Developer Tools and Services 4.16 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x as a component of OpenShift Developer Tools and Services 4.16 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x as a component of OpenShift Developer Tools and Services 4.16 | *, * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 as a component of OpenShift Developer Tools and Services 4.16 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 as a component of OpenShift Developer Tools and Services 4.16 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le as a component of OpenShift Developer Tools and Services 4.16 | * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 as a component of OpenShift Developer Tools and Services 4.16 | * |
Timeline
- Aug 26, 2026 CVE Published
- Oct 9, 2026 CVE Updated
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:60251 advisory
- https://access.redhat.com/security/cve/CVE-2024-29371 advisory
- https://access.redhat.com/security/cve/CVE-2025-14813 advisory
- https://access.redhat.com/security/cve/CVE-2025-67030 advisory
- https://access.redhat.com/security/cve/CVE-2026-0636 advisory
- https://access.redhat.com/security/cve/CVE-2026-1605 advisory
- https://access.redhat.com/security/cve/CVE-2026-2332 advisory
- https://access.redhat.com/security/cve/CVE-2026-3505 advisory
- https://access.redhat.com/security/cve/CVE-2026-40542 advisory
- https://access.redhat.com/security/cve/CVE-2026-41409 advisory
- https://access.redhat.com/security/cve/CVE-2026-41635 advisory
- https://access.redhat.com/security/cve/CVE-2026-42778 advisory
- https://access.redhat.com/security/cve/CVE-2026-42779 advisory
- https://access.redhat.com/security/cve/CVE-2026-47065 advisory
- https://access.redhat.com/security/cve/CVE-2026-50193 advisory
- https://access.redhat.com/security/cve/CVE-2026-53435 advisory
- https://access.redhat.com/security/cve/CVE-2026-53437 advisory
- https://access.redhat.com/security/cve/CVE-2026-54399 advisory
- https://access.redhat.com/security/cve/CVE-2026-54428 advisory
- https://access.redhat.com/security/cve/CVE-2026-54512 advisory
…and 147 more