Memory Exhaustion Vulnerability in JWCrypto by Latchset

CVE-2026-39373

What is CVE-2026-39373?

The JWCrypto library, which implements JWK, JWS, and JWE specifications using python-cryptography, is susceptible to a memory exhaustion issue. An unauthenticated attacker can exploit this vulnerability by sending specifically crafted JWE tokens that utilize ZIP compression. Although a prior patch limited the input token size to 250KB, it fails to validate the decompressed output size, allowing tokens within the input limit to expand to approximately 100MB in memory on constrained systems. This could lead to significant memory consumption and potential denial of service on affected servers. The issue has been addressed in version 1.5.7.

References