Lucene search

K
redhatcveRedhat.comRH:CVE-2024-33664
HistoryApr 26, 2024 - 6:04 a.m.

CVE-2024-33664

2024-04-2606:04:33
redhat.com
access.redhat.com
9
python-jose 3.3.0
denial of service
crafted jwe token
jwt bomb
cve-2024-33664
high compression ratio

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.8%

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a “JWT bomb.” This is similar to CVE-2024-21319.