CVE-2026-39373
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Apr 7, 2026
CISA due date
—
The record
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-jwcrypto | 0 | 1.5.7-2.1 |
Related vulnerabilities
- CVE-2026-92823 A flaw was found in libmodulemd. CWE-409
- CVE-2026-112892 Pillow is a Python imaging library. CWE-409
- CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
- CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
- CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409
- CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. CWE-409
- CVE-2026-44162 fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. CWE-409
- CVE-2026-85786 Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow… CWE-409