What’s Vulnerable › Vulnerabilities

CVE-2024-28102: JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-21 · updated 2026-06-17
• Weakness: CWE-770

Description

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

Affected products

• Debian Linux: 11.0
• latchset jwcrypto: before 1.5.6 — fixed in 1.5.6

How to fix

Upgrade to a fixed version: latchset jwcrypto 1.5.6. Check the vendor advisory for mitigations.

References

• https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f
• https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97
• https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f
• https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97
• https://lists.debian.org/debian-lts-announce/2024/09/msg00026.html
• https://www.vicarius.io/vsociety/posts/denial-of-service-vulnerability-discovered-in-jwcrypto-cve-2024-28102-28103

Get alerted when CVE-2024-28102 or the next vulnerability affects your stack