Package · Wolfi

py3.11-jwcrypto

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

Medium 5.3

CVE-2026-39373

JWCrypto: JWE ZIP decompression bomb

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token …

Latchset jwcrypto python-jwcrypto python-jwcrypto Debian Ubuntu Azure Linux Wolfi PyPI

Apr 7, 2026