{"id":"GO-2023-2334","summary":"Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3","details":"The go-jose package is subject to a \"billion hashes attack\" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.","aliases":["GHSA-2c7c-3mj9-8fqh"],"modified":"2026-02-04T02:43:28.428100Z","published":"2023-11-21T15:39:17Z","related":["CGA-qw38-mv85-36vx"],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2023-2334"},"references":[{"type":"FIX","url":"https://github.com/go-jose/go-jose/commit/65351c27657d58960c2e6c9fbb2b00f818e50568"},{"type":"REPORT","url":"https://github.com/go-jose/go-jose/issues/64"}],"affected":[{"package":{"name":"github.com/go-jose/go-jose/v3","ecosystem":"Go","purl":"pkg:golang/github.com/go-jose/go-jose/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/go-jose/go-jose/v3","symbols":["JSONWebEncryption.Decrypt","JSONWebEncryption.DecryptMulti","symmetricKeyCipher.decryptKey"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2023-2334.json"}},{"package":{"name":"github.com/square/go-jose","ecosystem":"Go","purl":"pkg:golang/github.com/square/go-jose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/square/go-jose","symbols":["JSONWebEncryption.Decrypt","JSONWebEncryption.DecryptMulti","symmetricKeyCipher.decryptKey"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2023-2334.json"}}],"schema_version":"1.7.3"}