AZL-82055
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-82055.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-82055
- Upstream
- Published
- 2026-04-07T20:16:32Z
- Modified
- 2026-08-30T05:24:52Z
- Summary
- CVE-2026-39373 affecting package python-jwcrypto 0.6.0-9
- Details
-
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.
- References