5.9 Medium

CVE-2026-80179 Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

Description

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: High
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Ansible Automation Platform 2	Versions not published
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 9	Versions not published
Red Hat OpenShift AI (RHOAI)	Versions not published
Red Hat OpenStack Platform 16.2	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2524147 bugzilla.redhat.com
github.com github.com

Timeline

Published August 27, 2026
Last modified November 6, 2026

The 210 CVEs of Red Hat Ansible Automation Platform 2 →

CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a… 3.3 Low CVE-2026-109131 Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl) 5.4 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High

Track this CVE