Read the docs
TI-2016-05392 Aliases CVE-2016-6298GHSA-wg33-x934-3ghh

The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before…

Priority LOW 28CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

Why it matters now

EPSS 0.02226 82nd percentileScored 2026-11-07
Fix Fixed jwcrypto (PyPI): 0.3.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—jwcrypto (PyPI)before 0.3.20.3.2Patch availableGHSA-wg33-x934-3ghh
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • jwcrypto (PyPI) Vendor— Affected before 0.3.2 Fixed in 0.3.2 Patch available GHSA-wg33-x934-3ghh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*before 0.3.2Vulnerablelatchset
  • cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:* Versions before 0.3.2 Vulnerable ·latchset

Remediation

  • Fix · GHSA-wg33-x934-3ghh jwcrypto (PyPI) Fixed in 0.3.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6298
  2. 2026-10-03 Alias added: GHSA-wg33-x934-3ghh

References

Patch 3

Advisory 2

Other 3

  • TI-2026-28360 JWCrypto: JWE ZIP decompression bomb CVSS 3.1MEDIUM 5.3
  • TI-2024-18683 JWCrypto vulnerable to JWT bomb Attack in `deserialize` function CVSS 3.1MEDIUM 6.8
  • TI-2023-06111 Jwcrypto: denail of service via specifically crafted jwe CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences