CVE-2026-80179
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
Risk Assessment
The attack can cause memory exhaustion and service crashes, leading to unavailability of applications using jwcrypto.
Recommendation
It is recommended to update jwcrypto to the latest version that includes a fix to limit memory allocation, and to validate JWE tokens before deserialization.
Other vulnerabilities in jwcrypto
Original NVD description (English source)
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.