go jose vulnerability

The go jose vulnerability tag covers CVE-2024-28180, an improper handling of highly compressed data flaw in the Go implementation of JOSE (JSON Object Signing and Encryption). This data amplification issue allows an attacker to send a crafted JWE that forces the recipient to decompress data far larger than expected, consuming excessive CPU and memory and potentially causing denial-of-service conditions. Services calling Decrypt or DecryptMulti without defensive limits are at risk. The tag includes discussion of the vulnerability, its impact, and patching guidance for affected systems.