github.com/lestrrat-go/jwx/v2
Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe
View on Github
Activity
- Latest release
- 2mo ago
- Total releases
- 33
- Cadence
- ~21 days
- Last 12 months
- 1
Reach
- Stars
- 2.4k
Details
- First release
- Apr 03, 2022
| Version | Released | |
|---|---|---|
v2.1.7
patch
|
v2.1.7
patch
Dependencies (9)
+ 1 more |
|
v2.1.6
patch
|
v2.1.6
patch
Dependencies (9)
+ 1 more |
|
v2.1.5
patch
|
v2.1.5
patch
Dependencies (9)
+ 1 more |
|
v2.1.4
patch
|
v2.1.4
patch
Dependencies (9)
+ 1 more |
|
v2.1.3
patch
|
v2.1.3
patch
Dependencies (9)
+ 1 more |
|
v2.1.2
patch
|
v2.1.2
patch
Dependencies (9)
+ 1 more |
|
v2.1.1
patch
|
v2.1.1
patch
Dependencies (9)
+ 1 more |
|
v2.1.0
minor
|
v2.1.0
minor
Dependencies (9)
+ 1 more |
|
v2.0.21
patch
|
v2.0.21
patch
Dependencies (9)
+ 1 more |
|
v2.0.20
patch
1 CVE
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.20
patch
Dependencies (9)
+ 1 more |
|
v2.0.19
patch
1 CVE
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.19
patch
Dependencies (9)
+ 1 more |
|
v2.0.18
patch
2 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.18
patch
Dependencies (9)
+ 1 more |
|
v2.0.17
patch
3 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.17
patch
Dependencies (9)
+ 1 more |
|
v2.0.16
patch
3 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.16
patch
Dependencies (9)
+ 1 more |
|
v2.0.15
patch
3 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.15
patch
Dependencies (9)
+ 1 more |
|
v2.0.14
patch
3 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.14
patch
Dependencies (9)
+ 1 more |
|
v2.0.13
patch
3 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.13
patch
Dependencies (9)
+ 1 more |
|
v2.0.12
patch
3 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.12
patch
Dependencies (9)
+ 1 more |
|
v2.0.11
patch
3 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev |
v2.0.11
patch
Dependencies (9)
+ 1 more |
|
v2.0.10
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.10
patch
Dependencies (9)
+ 1 more |
|
v2.0.9
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.9
patch
Dependencies (8)
|
|
v2.0.8
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.8
patch
Dependencies (8)
|
|
v2.0.7
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.7
patch
Dependencies (8)
|
|
v2.0.6
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.6
patch
Dependencies (8)
|
|
v2.0.5
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.5
patch
Dependencies (8)
|
|
v2.0.4
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.4
patch
Dependencies (8)
|
|
v2.0.3
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.3
patch
Dependencies (8)
|
|
v2.0.2
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.2
patch
Dependencies (8)
|
|
v2.0.1
patch
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.1
patch
Dependencies (8)
|
|
v2.0.0
initial
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.0
initial
Dependencies (8)
|
|
v2.0.0-beta2
pre
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.0-beta2
pre
Dependencies (8)
|
|
v2.0.0-beta1
pre
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.0-beta1
pre
Dependencies (8)
|
|
v2.0.0-alpha1
pre
4 CVEs
CVE-2024-28122
GO-2024-2632
GHSA-hj3v-m684-v259
May 20, 2024
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression. Fixed in
2.0.21
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-21664
GO-2024-2454
GHSA-pvcr-v8j8-j5q3
Jan 23, 2024
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2 Fixed in
2.0.19
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-49290
GO-2023-2379
GHSA-7f9x-gw85-8grf
Dec 11, 2023
Denial of service due to malicious parameters in github.com/lestrrat-go/jwx The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption. Fixed in
2.0.18
References Updated Feb 04, 2026 · Source: OSV.dev
GO-2023-1859
GHSA-rm8v-mxj3-5rmq
Jun 22, 2023
Padding oracle vulnerability in github.com/lestrrat-go/jwx AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data. Fixed in
2.0.11-0.20230614080639-c8b6bec919a1
References Updated May 20, 2024 · Source: OSV.dev |
v2.0.0-alpha1
pre
Dependencies (8)
|