Low ELSA-2026-19042 1 CVE

Low: python-jwcrypto security update (Oracle Linux 10)

Published Jul 8, 2026 · Updated Jul 8, 2026

Ecosystem: Oracle Linux

Summary

[1.5.6-5]
- Fix CVE-2026-39373: Memory exhaustion via crafted compressed JWE tokens

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 10	python3-jwcrypto	0:1.5.6-5.el10_2

Vulnerabilities 1

Medium 5.3

CVE-2026-39373

JWCrypto: JWE ZIP decompression bomb

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token …

Latchset jwcrypto python-jwcrypto python-jwcrypto Debian Ubuntu Azure Linux Wolfi PyPI

Apr 7, 2026