Astra Linux – Vulnerability in python-jwcrypto

JWCrypto implements the JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker could cause a denial-of-service attack by passing in a malicious JWE Token with a high compression ratio. When the server processed this token, it would consume a lot of memory...

cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227 JWT Authentication Bypass Demo Project Goal This project demonstrates the CVE-2022-39227 vulnerability in a controlled local lab environment. This vulnerability affects the python-jwt library versions 3.3.4 and allows an attacker to forge JWT claims without knowing the secret key b...

Important: python-jwcrypto

Issue Overview: A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large keyops array to an...

Amazon Linux 2023 : python3-jwcrypto (ALAS2023-2026-3158)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3158 advisory. A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A...

python313-jwcrypto-1.6.1-1.1 on GA media (moderate)

python313-jwcrypto-1.6.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11972-1 Rating: moderate Cross-References: CVE-2026-92091 CVSS scores: CVE-2026-92091 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2026-92091 SUSE : 6.3...

PT-2026-105681

These are all security issues fixed in the python313-jwcrypto-1.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11972-1 python313-jwcrypto-1.6.1-1.1 on GA media

These are all security issues fixed in the python313-jwcrypto-1.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

Rocky Linux 9 [CIQ] Security Update: python3-jwcrypto (crlsa-2026_19197)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202619197 advisory. JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens CVE-2026-39373 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: bind-dyndb-ldap / bind-dyndb-ldap-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3267)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243267 advisory. JWCrypto: denail of service Via specifically crafted JWE CVE-2023-6681 python-jwcrypto: malicious JWE token can cause denial of service CVE-2024-28102...

Rocky Linux 10.2 [CIQ] Security Update: python3-jwcrypto (crlsa-2026_19042)

The Rocky Linux 10.2 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202619042 advisory. JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens CVE-2026-39373 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: python3-jwcrypto (crlsa-2024_2559)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20242559 advisory. python-jwcrypto: malicious JWE token can cause denial of service CVE-2024-28102 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: custodia / python3-custodia / python3-jwcrypto / python3-pyusb / etc Multiple Vulnerabilities (crlba-2019_4268)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlba-20194268 advisory. Bug Fixes: IPA upgrade fails for latest ipa package when adtrust is installed BZ1773516 This advisory is provided by Ctrl IQ, Inc for Rocky Linux systems...

Rocky Linux 9 [CIQ] Security Update: python3-jwcrypto (crlsa-2024_9281)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20249281 advisory. JWCrypto: denail of service Via specifically crafted JWE CVE-2023-6681 Tenable has extracted the preceding description block directly from the CIQ security advisory...

OESA-2026-4066 python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote,...

Linux Distros Unpatched Vulnerability : CVE-2026-92091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and...

Security update for python-jwcrypto (moderate)

openSUSE Security Update: Security update for python-jwcrypto Announcement ID: openSUSE-SU-2026:0328-1 Rating: moderate References: 1277639 Cross-References: CVE-2026-80179 CVSS scores: CVE-2026-80179 SUSE: 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Affected Products:...

SUSE CVE-2026-92091

A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large keyops array to an application that...

[SECURITY] Fedora 44 Update: python-jwcrypto-1.6.0-1.fc44

Implements JWK, JWS, JWE specifications using python-cryptography...

[SECURITY] Fedora 45 Update: python-jwcrypto-1.6.0-1.fc45

Implements JWK, JWS, JWE specifications using python-cryptography...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the JWK.importkey method, whose keyops duplicate detection rescans the whole array for every element and enforces no size limit, making the check On^2 over untrusted parsed JWK data. An attacker can...