Skip to content
OpenAdvisories

Product · Latchset

jwcrypto

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-39373

    JWCrypto: JWE ZIP decompression bomb

    JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token …

    Latchset jwcrypto python-jwcrypto python-jwcrypto Debian Ubuntu PyPI
  • Medium 6.8
    CVE-2024-28102

    JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

    JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, i…

    Latchset jwcrypto python-jwcrypto python-jwcrypto Debian Ubuntu PyPI