Memory Allocation Flaw in jwcrypto Affects Services Processing JWE Tokens
CVE-2026-80179

5.9MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Openshift Ai (rhoai)
Vendor: CVE Published:; 27 August 2026

What is CVE-2026-80179?

A vulnerability exists in jwcrypto that allows remote attackers to exploit a flaw by sending a malformed JSON Web Encryption (JWE) token with multiple period delimiters. Exploiting this weakness can invoke the JWE.deserialize() function to allocate an excessive amount of memory, leading to a MemoryError. As a result, services that trust and process untrusted JWE values may experience a denial of service, making them unable to handle requests effectively.