PYSEC-2025-185

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/python-jose/PYSEC-2025-185.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2025-185

Aliases

Published

2025-12-17T16:16:04Z

Modified

2026-06-10T17:11:01Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

[none]

Details

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

References

Affected packages

PyPI / python-jose

Package

Name: python-jose; View open source insights on deps.dev
Purl: pkg:pypi/python-jose

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.3.0

Affected versions

0.*

0.1.0

0.1.1

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.2.0

0.3.0

0.4.0

0.5.0

0.5.1

0.5.2

0.5.3

0.5.4

0.5.5

0.5.6

0.6.1

0.6.2

0.7.0

1.*

1.0.0

1.1.0

1.2.0

1.3.0

1.3.1

1.3.2

1.4.0

2.*

2.0.0

2.0.1

2.0.2

3.*

3.0.0

3.0.1

3.1.0

3.2.0

3.3.0

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/python-jose/PYSEC-2025-185.yaml"