CVE catalog

CVE-2025-63811

golang-github-dvsekhvalnov-jose2go: CVE-2025-63811

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.28% · Oct 25, 2026

An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high compression ratio.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-dvsekhvalnov-jose2gosid1.11.0-1fixed
Debiangolang-github-dvsekhvalnov-jose2goforky1.11.0-1fixed
Debiangolang-github-dvsekhvalnov-jose2gotrixie1.5-1vulnerable
Debiangolang-github-dvsekhvalnov-jose2gobookworm1.5-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-dvsekhvalnov-jose2gosourcesid1.9-1not yet assignedNot reported[1120701]
Debiangolang-github-dvsekhvalnov-jose2gosourceforky1.9-1not yet assignedNot reported[1120701]
Debiangolang-github-dvsekhvalnov-jose2gosourcetrixie(unfixed)not yet assignedNot reported[1120701]
Debiangolang-github-dvsekhvalnov-jose2gosourcebookworm(unfixed)not yet assignedNot reported[1120701]

[Debian bug #1120701]

Notes

[trixie] golang-github-dvsekhvalnov-jose2go: Minor issue [bookworm] golang-github-dvsekhvalnov-jose2go: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-dvsekhvalnov-jose2go-dev]Affected

    Source package: [golang-github-dvsekhvalnov-jose2go]

    Details (2)

    • 1.5-1 · all · bookworm

      Affected

      dsa · golang-github-dvsekhvalnov-jose2go · debian · bookworm; dsa · golang-github-dvsekhvalnov-jose2go · debian · 12

    • 1.5-1 · all · bookworm

      Affected

      dsa · golang-github-dvsekhvalnov-jose2go · debian · bookworm; dsa · golang-github-dvsekhvalnov-jose2go · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]