CVE-2025-63811 jose2go is vulnerable to a JWT bomb attack through its decode function
An attacker can cause a Denial-of-Service in the jose2go library by sending a crafted JWE token with a high compression ratio.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-63811?
CVE-2025-63811 is a high-severity denial of service vulnerability in n/a, published on 12 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high compression ratio.
Weakness: CWE-400
Which versions are affected by CVE-2025-63811?
3 open source packages ship an affected version, including github.com/dvsekhvalnov/jose2go. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dvsekhvalnov/jose2go Go | All versions | 1.7.0 |
github.com/dvsekhvalnov/jose2go Go | All versions | 1.7.0 |
github.com/dvsekhvalnov/jose2go Go | All versions | 1.7.0 |
Products include Dvsekhvalnov Jose2go.
How do I fix CVE-2025-63811?
Upgrade github.com/dvsekhvalnov/jose2go to 1.7.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-63811 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-63811 exists.
Other vulnerabilities in n/a
Sources
Also known as CLEANSTART-2026-TQ82043, DEBIAN-CVE-2025-63811, GHSA-9mj6-hxhv-w67j, GO-2025-4123, MINI-25jm-p522-2j6c, MINI-8g87-g6cg-gcp9 and 10 more.