Skip to content
fr Sign in
6.8 Medium

CVE-2024-28102 JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography

Description

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

Affected products and versions

Product Affected versions Fixed in
jwcrypto 1.5 earliest → < 1.5.6 1.5.6

References

Timeline

  1. Published
  2. Last modified

Other CVEs of jwcrypto

The 2 CVEs of jwcrypto →
CVE-2026-39373 JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography 5.3 Medium
Track this CVE