jose4j Denial-of-Service Vulnerability via Malicious JWE Token Compression

A denial-of-service vulnerability has been identified in jose4j versions prior to 0.9.5. The issue arises when an attacker crafts a JSON Web Encryption (JWE) token with a very high compression ratio. When the server processes this token, it leads to excessive memory usage and prolonged processing times during decompression, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing significant memory consumption and increased processing times on the server.