-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a Denial-of-Service (DoS) attack known as a 'deflate bomb' in the jose2go library. The root cause lies in the Deflate.Decompress function in deflate.go. In vulnerable versions, this function used ioutil.ReadAll to decompress the entire payload from a flate.Reader into memory without imposing any limits on the output size. An attacker could craft a small, highly-compressed JWE token that, when decompressed, expands to a massive size, exhausting system memory and causing the application to crash.
The exploit is triggered through the public Decode function, which is the standard way to process a token. This function calls the internal decrypt function, which identifies the compression algorithm (DEF) and invokes the vulnerable Deflate.Decompress method.
The patch mitigates this by introducing a maxBytesReader, which wraps the flate.Reader and enforces a limit on the number of bytes that can be read. The Decompress function's signature was changed to return an error, which is now checked in the decrypt function. By default, a 250KB limit is introduced, and the library now provides a way to customize this limit, preventing the uncontrolled memory allocation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/dvsekhvalnov/jose2go | go | < 1.7.0 | 1.7.0 |
A Semantic Attack on Google Gemini - Read the Latest Research