CVE-2026-39373High· 7.5▾ TwilightA flaw was found in JWCrypto, a Python library for JSON Web Key (JWK), JSON Web Signature (JWS), and JSON Web Encryption (JWE) specifications. An unauthenticated attacker can exploit this vulnerability by sending specially crafted JWE toke…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
5.3 → 7.5
medium → high
A flaw was found in JWCrypto, a Python library for JSON Web Key (JWK), JSON Web Signature (JWS), and JSON Web Encryption (JWE) specifications. An unauthenticated attacker can exploit this vulnerability by sending specially crafted JWE tokens that use ZIP compression. While the input token size is limited, the decompressed output size is not validated, allowing an attacker to cause excessive memory consumption. This can lead to memory exhaustion on affected systems, resulting in a Denial of Service (DoS).
JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens — rated Low by Red Hat. Released 2026-04-07, updated 2026-09-14.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:59135 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:13512 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:59136
Affected packages:
jwcrypto < 1.5.7Patched in:
jwcrypto 1.5.7Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-59682High· 8.8django: Potential partial directory-traversal via archive.extract() (CVE-2025-59682)
CVE-2025-69228Medium· 6.8aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request (CVE-2025-69228)
CVE-2026-18618High· 7.5A flaw was found in ml-metadata
CVE-2025-2559Medium· 4.9A flaw was found in Keycloak
CVE-2026-10832Medium· 5.9A flaw was found in the DERDecoder class within wildfly-elytron-asn1
CVE-2026-93491High· 7.5A flaw was found in Netty's HttpServerCodec