Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 10 enterprise_linux:10.3 | python-jwcrypto | 0:1.6.1-1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | python3-jwcrypto | 0:1.6.1-1.el10_3 |
Vulnerabilities 2
-
Medium 5.9
Jwcrypto: jwcrypto: denial of service via malformed jwe tokens
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a Memory…
-
Medium 5.9
Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array
A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK wit…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2524147
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2533849
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98061.json
-
report
https://access.redhat.com/security/cve/CVE-2026-80179
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-80179
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-80179
-
article
https://github.com/latchset/jwcrypto/security/advisories/GHSA-96rv-c4vc-h4f4
-
report
https://access.redhat.com/security/cve/CVE-2026-92091
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-92091
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-92091
-
article
https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h