What’s Vulnerable › Vulnerabilities
CVE-2026-39373: JWCrypto: JWE ZIP decompression bomb
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-04-07 · updated 2026-07-24
- Weakness: CWE-409
Description
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.
Affected products
- latchset jwcrypto: before 1.5.7 — fixed in 1.5.7
How to fix
Upgrade to a fixed version: latchset jwcrypto 1.5.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-39373 or the next vulnerability affects your stack