CVE-2024-29370
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Risk Assessment
The vulnerability may lead to server resource exhaustion (memory and CPU time), potentially causing denial of service for legitimate users and disrupting application availability.
Recommendation
Update the python-jose library to a patched version or implement limits on the size and compression ratio of processed JWE tokens.
Other vulnerabilities in python-jose
See all- CVE-2026-120459High
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims.
- CVE-2026-85394Critical
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.
- CVE-2016-7036Critical
Versions of python-jose before 1.3.2 do not use constant time comparison for HMAC keys, which can be leveraged by attackers in unspecified ways.
Original NVD description (English source)
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS