Rocky Linux 9 [CIQ] Security Update: python3-jwcrypto (crlsa-2024_2559)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20242559 advisory. python-jwcrypto: malicious JWE token can cause denial of service CVE-2024-28102 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: bind-dyndb-ldap / bind-dyndb-ldap-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3267)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243267 advisory. JWCrypto: denail of service Via specifically crafted JWE CVE-2023-6681 python-jwcrypto: malicious JWE token can cause denial of service CVE-2024-28102...

AZL-98337 CVE-2026-80179 affecting package python-jwcrypto 0.6.0-9

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

CVE-2026-80179

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

UBUNTU-CVE-2026-80179

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-80179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed...

CVE-2026-80179 Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

EUVD-2026-67278

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to denial of service due to jose4j (CVE-2024-29371)

Summary IBM Storage Protect for Space Management uses the jose4j library as part of its security infrastructure. A vulnerability in jose4j could allow an attacker to cause a denial of service DoS by sending a specially crafted JSON Web Encryption JWE token with an exceptionally high compression...

Security Bulletin: A security vulnerability may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Standard.

Summary A security vulnerability may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Standard CVE-2024-29371. IBM WebSphere Liberty has been updated within IBM CICS TX Standard to address this vulnerability. Vulnerability Details CVEID:CVE-2024-29371 DESCRIPTION: In jose4j before...

Exploit for CVE-2026-29000

CVE-2026-29000 – pac4j JWT Authentication Bypass Python PoC...

joserfc 安全漏洞

Joserfc is a Python library developed by Authlib. Joserfc versions 1.6.2 and earlier have security vulnerabilities. These vulnerabilities stem from the lack of verification or restrictions on the p2c parameter value in the JWE token. This allows unverified attackers to cause denial-of-service...

SUSE CVE-2024-29371

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during...

Linux Distros Unpatched Vulnerability : CVE-2024-29371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In jose4j before 0.9.6, an attacker can cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high...

jose4j is vulnerable to DoS via compressed JWE content

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during...

PYSEC-2025-185

In python-jose 3.3.0 specifically jwe.decrypt, a vulnerability allows an attacker to cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant...

CVE-2024-29371

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during...

UBUNTU-CVE-2024-29371

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during...

CVE-2024-29371

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during...

PT-2025-55355

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cjwg-qfpm-7377. This link is maintained to preserve external references. Original Description In python-jose 3.3.0 specifically jwe.decrypt, a vulnerability allows an attacker to cause a Denial-of-Service DoS...