VDB
RHSA-2026:60256
RHSA-2026:60256
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 as a component of OpenShift Developer Tools and Services 4.22 | *, * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x as a component of OpenShift Developer Tools and Services 4.22 | *, * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 as a component of OpenShift Developer Tools and Services 4.22 | *, * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le as a component of OpenShift Developer Tools and Services 4.22 | *, * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 as a component of OpenShift Developer Tools and Services 4.22 | *, * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 as a component of OpenShift Developer Tools and Services 4.22 | *, * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x as a component of OpenShift Developer Tools and Services 4.22 | *, * |
| Red Hat | registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le as a component of OpenShift Developer Tools and Services 4.22 | *, * |
Timeline
- Aug 26, 2026 CVE Published
- Oct 9, 2026 CVE Updated
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:60256 advisory
- https://access.redhat.com/security/cve/CVE-2024-29371 advisory
- https://access.redhat.com/security/cve/CVE-2025-14813 advisory
- https://access.redhat.com/security/cve/CVE-2025-67030 advisory
- https://access.redhat.com/security/cve/CVE-2026-0636 advisory
- https://access.redhat.com/security/cve/CVE-2026-1605 advisory
- https://access.redhat.com/security/cve/CVE-2026-2332 advisory
- https://access.redhat.com/security/cve/CVE-2026-3505 advisory
- https://access.redhat.com/security/cve/CVE-2026-40542 advisory
- https://access.redhat.com/security/cve/CVE-2026-41409 advisory
- https://access.redhat.com/security/cve/CVE-2026-41635 advisory
- https://access.redhat.com/security/cve/CVE-2026-42778 advisory
- https://access.redhat.com/security/cve/CVE-2026-42779 advisory
- https://access.redhat.com/security/cve/CVE-2026-47065 advisory
- https://access.redhat.com/security/cve/CVE-2026-50193 advisory
- https://access.redhat.com/security/cve/CVE-2026-53435 advisory
- https://access.redhat.com/security/cve/CVE-2026-53437 advisory
- https://access.redhat.com/security/cve/CVE-2026-54399 advisory
- https://access.redhat.com/security/cve/CVE-2026-54428 advisory
- https://access.redhat.com/security/cve/CVE-2026-54512 advisory
…and 147 more