CVE-2025-7071

The CVE concerns Oberon microsystems AG ocrypto library. A padding oracle timing side-channel in AES-CBC decryption with PKCS#7 padding exists for ocrypto versions 3.1.0 through 3.9.1 (i.e., all versions since 3.1.0 up to but not including 3.9.2). Attackers could recover plaintexts by measuring d...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...