CVE-2023-51775

17

FAUCET Score

CVE-2023-51775 is a denial-of-service vulnerability affecting jose4j versions prior to 0.9.4, where a large p2c value can lead to excessive CPU consumption. With a CVSS score of 6.5 (Medium), this vulnerability can be exploited remotely with low attack complexity and requires low privileges, potentially causing a denial of service. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 0.9.4CPE matchmatch criteria	cpe:2.3:a:jose4j_project:jose4j::::::::

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

2.8

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.88%

Probability of exploitation in next 30 days

EPSS Percentile

55.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0088 is in the 67th percentile among its peer group of 21,974 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (59)

mavenpatch availablevia ghsa

Product: org.bitbucket.b_c:jose4jFixed in: 0.9.4

redhatpatch availablevia redhat_api

Product: HawtIO 4.0.0 for Red Hat build of Apache Camel 4Fixed in: jose4j

redhatpatch availablevia redhat_api

Product: Red Hat build of Apicurio Registry 2.6.1 GAFixed in: jose4j

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: jose4j

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-hal-console-0:3.3.24-1.Final_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-hibernate-validator-0:6.0.23-2.SP1_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-insights-java-client-0:1.1.3-1.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-ironjacamar-0:1.5.18-1.Final_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jboss-cert-helper-0:1.1.3-1.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jboss-ejb-client-0:4.0.55-1.Final_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jboss-server-migration-0:1.10.0-39.Final_redhat_00039.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jbossws-cxf-0:5.4.12-1.Final_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jsoup-0:1.15.4-1.redhat_00003.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-undertow-jastow-0:2.0.15-1.Final_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-xalan-j2-0:2.7.1-37.redhat_00015.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-hal-console-0:3.3.24-1.Final_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-hibernate-validator-0:6.0.23-2.SP1_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-insights-java-client-0:1.1.3-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-ironjacamar-0:1.5.18-1.Final_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jboss-cert-helper-0:1.1.3-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jboss-ejb-client-0:4.0.55-1.Final_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jboss-server-migration-0:1.10.0-39.Final_redhat_00039.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jbossws-cxf-0:5.4.12-1.Final_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jsoup-0:1.15.4-1.redhat_00003.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-undertow-jastow-0:2.0.15-1.Final_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-wildfly-0:7.4.19-1.GA_redhat_00002.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-xalan-j2-0:2.7.1-37.redhat_00015.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-hal-console-0:3.3.24-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-hibernate-validator-0:6.0.23-2.SP1_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-insights-java-client-0:1.1.3-1.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-ironjacamar-0:1.5.18-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-jboss-cert-helper-0:1.1.3-1.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-jboss-ejb-client-0:4.0.55-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-jboss-server-migration-0:1.10.0-39.Final_redhat_00039.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-jbossws-cxf-0:5.4.12-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-jsoup-0:1.15.4-1.redhat_00003.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-undertow-jastow-0:2.0.15-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-wildfly-0:7.4.19-1.GA_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-xalan-j2-0:2.7.1-37.redhat_00015.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: jose4j

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform Expansion Pack

redhatpatch availablevia redhat_api

Product: RHOSS-1.33-RHEL-8Fixed in: openshift-serverless-1/logic-data-index-ephemeral-rhel8:1.33.0-5

redhatpatch availablevia redhat_api

Product: RHOSS-1.33-RHEL-8Fixed in: openshift-serverless-1/logic-data-index-postgresql-rhel8:1.33.0-5

redhatpatch availablevia redhat_api

Product: RHOSS-1.33-RHEL-8Fixed in: openshift-serverless-1/logic-jobs-service-ephemeral-rhel8:1.33.0-5

redhatpatch availablevia redhat_api

Product: RHOSS-1.33-RHEL-8Fixed in: openshift-serverless-1/logic-jobs-service-postgresql-rhel8:1.33.0-5

redhatpatch availablevia redhat_api

Product: RHOSS-1.33-RHEL-8Fixed in: openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8:1.33.0-5

redhatpatch availablevia redhat_api

Product: RHOSS-1.33-RHEL-8Fixed in: openshift-serverless-1/logic-operator-bundle:1.33.0-5

redhatpatch availablevia redhat_api

Product: RHOSS-1.33-RHEL-8Fixed in: openshift-serverless-1/logic-rhel8-operator:1.33.0-3

redhatpatch availablevia redhat_api

Product: RHOSS-1.33-RHEL-8Fixed in: openshift-serverless-1/logic-swf-builder-rhel8:1.33.0-5

redhatpatch availablevia redhat_api

Product: RHOSS-1.33-RHEL-8Fixed in: openshift-serverless-1/logic-swf-devmode-rhel8:1.33.0-5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-wildfly-0:7.4.19-1.GA_redhat_00002.1.el8eap

redhatno patchvia redhat_api

Product: Red Hat build of Apache Camel - HawtIO 4Fixed in: jose4j

redhatno patchvia redhat_api

Product: Red Hat Build of KeycloakFixed in: jose4j

redhatno patchvia redhat_api

Product: Red Hat build of QuarkusFixed in: org.bitbucket.b_c/jose4j

redhatno patchvia redhat_api

Product: Red Hat Process Automation 7Fixed in: jose4j

redhatno patchvia redhat_api

Product: streams for Apache KafkaFixed in: jose4j

redhatend of lifevia redhat_api

Product: Red Hat Single Sign-On 7Fixed in: jose4j

redhatend of lifevia redhat_api

Product: Red Hat Fuse 7Fixed in: jose4j

redhatend of lifevia redhat_api

Product: Red Hat Integration Camel K 1Fixed in: jose4j

Vendor Advisories (2)

mavenGHSA-6qvw-249j-h44cmedium

jose4j denial of service via specifically crafted JWE

redhatCVE-2023-51775Moderate

jose4j: denial of service via specially crafted JWE

References

security.netapp.com / advisory/ntap-20241108-0002

bitbucket.org / b_c/jose4j/issues/212

ExploitIssue Tracking